EUVD-2026-34292
GHSA-jh6h-v6mp-h22v
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3d932f1c3e065351c4440c27abe1e6479752544d. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Weak hashing in milvus-io/milvus up to 2.6.13 exposes the Grantee ID Hash Handler in the KV metadata catalog (internal/metastore/kv/rootcoord/kv_catalog.go), allowing a low-privileged local attacker to predict or forge 16-character grantee IDs used in RBAC privilege assignments backed by etcd. Successful exploitation - rated high complexity - could result in unauthorized manipulation of access control metadata, yielding low-level confidentiality, integrity, and availability impact on the affected Milvus instance. A proof-of-concept has been publicly disclosed via GitHub issue #49857, though no active exploitation is confirmed in CISA KEV.
Technical ContextAI
Milvus is an open-source vector database (CPE: cpe:2.3:a:milvus-io:milvus:*:*:*:*:*:*:*:*) that uses an etcd-backed key-value metadata store managed through its rootcoord component to store RBAC privilege grants. The vulnerability (CWE-328: Use of Weak Hash) resides in the Grantee ID Hash Handler within kv_catalog.go. As revealed by the PR #50060 diff, legacy grantee IDs were 16 characters long - a truncated, cryptographically insufficient hash. The fix introduces a crypto.GranteeID() function producing stronger identifiers, along with isLegacyGranteeID() (checking len(idStr) == 16) and migrateGranteeID() for backward-compatible transition of existing stored entries. The short hash length makes collision attacks or ID prediction feasible under the right conditions, undermining the integrity of the RBAC grant store.
RemediationAI
Apply the upstream fix via commit 3d932f1c3e065351c4440c27abe1e6479752544d, available in PR #50060 at https://github.com/milvus-io/milvus/pull/50060. Note that a specific tagged release version incorporating this patch is not independently confirmed from available data - organizations should monitor https://github.com/milvus-io/milvus/ for an official release and treat the fix as 'upstream fix available (PR/commit); released patched version not independently confirmed.' The patch includes migration logic that rewrites stored 16-character legacy grantee IDs to the stronger format on access, which may cause brief operational overhead during the transition. As compensating controls until the patch is applied: restrict local system access to the Milvus host to trusted accounts only, audit etcd grantee ID entries for unexpected or duplicate 16-character IDs, and monitor for anomalous RBAC privilege changes in Milvus logs. Disabling RBAC entirely is not recommended as a workaround, as it removes all access control.
Unauthenticated API access in Milvus vector database before 2.5.27/2.6.10. TCP port 9091 exposed by default without auth
Unauthenticated denial of service in Milvus through 2.6.22 and 3.0.0 allows any remote attacker with network access to p
Same weakness CWE-328 – Use of Weak Hash
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today