Milvus
CVE-2026-26190
CRITICAL
GHSA-7ppg-37fh-vcr6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to TCP port 9091
-
ExploitAccess /expr endpoint with default token
-
ExecutionEvaluate arbitrary expressions
-
ImpactManipulate database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Milvus versions prior to 2.5.27 and 2.6.10 with TCP port 9091 exposed and /expr debug endpoint enabled using default etcd.rootPath authentication token (by-dev). REST API (/api/v1/*) registered on metrics/management port without authentication. |
| Impact | CVSS 9.8. Vector databases store embeddings for AI applications — unauthorized access enables data theft and model poisoning. |
| Exploit ScenarioDerived | Attacker connects to exposed Milvus port 9091, accesses or modifies vector embeddings used by AI applications. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthenticated API access in Milvus vector database before 2.5.27/2.6.10. TCP port 9091 exposed by default without authentication. EPSS 0.32% with PoC and patch available.
Earlier versions of this analysis (1)
Unauthenticated vector database access in Milvus.
RemediationAI
Update Milvus. Configure authentication. Restrict port 9091 access.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-306 in Milvus, a popular vector database for AI/ML applications. Default configuration exposes management port without auth.
Know when Milvus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.
Executive ViewAI
Milvus vector databases in your environment are exposed to critical authentication bypass attacks through an unpatched default configuration, potentially allowing unauthorized access to sensitive AI/ML data and models. Organizations running Milvus versions prior to 2.5.27 or 2.6.10 face immediate risk of data exfiltration and system compromise if port 9091 remains exposed to networks.
Apply vendor patch. Until patching is complete: restrict network access to port 9091 via firewall rules to only trusted internal networks; implement IP whitelisting; disable Milvus instances not currently in use; monitor port 9091 for unauthorized connection attempts; consider deploying a reverse proxy with authentication in front of Milvus services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Unauthenticated denial of service in Milvus through 2.6.22 and 3.0.0 allows any remote attacker with network access to p
Weak hashing in milvus-io/milvus up to 2.6.13 exposes the Grantee ID Hash Handler in the KV metadata catalog (internal/m
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB