EUVD-2026-34997
GHSA-43px-gpwc-q84v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collection_router.py. This manipulation of the argument kwargs causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
AnalysisAI
Improper access control in zilliztech deep-searcher up to version 0.0.2 allows authenticated remote attackers to bypass collection-level authorization in the vector database layer. The CollectionRouter.invoke function in collection_router.py lists and queries all vector database collections without filtering by the caller's authorized scope, meaning a low-privileged user can retrieve data from collections they should not have access to. No public exploit identified via CISA KEV, but publicly available exploit code (POC) exists per the GitHub issue tracker and the CVSS 4.0 E:P modifier confirms this.
Technical ContextAI
deep-searcher is an AI-powered retrieval-augmented generation (RAG) framework by Zilliz (cpe:2.3:a:zilliztech:deep-searcher:*:*:*:*:*:*:*:*) that routes queries across vector database collections using a CollectionRouter agent component. The root cause is CWE-284 (Improper Access Control): the CollectionRouter.invoke method in deepsearcher/agent/collection_router.py called self.vector_db.list_collections(dim=dim) unconditionally, returning all available collections regardless of the caller's authorization context. The fix, visible in PR #268, introduces _filter_authorized_collections and filter_authorized_collection_names methods that check kwargs for authorized_collection_set or authorized_collections parameters and restrict the collection list accordingly. The same bypass existed in chain_of_rag.py and deep_search.py, which also used self.collection_router.all_collections without authorization filtering. The vulnerability is architectural - the access control layer was simply absent, not broken.
RemediationAI
An upstream fix is available via GitHub Pull Request #268 (https://github.com/zilliztech/deep-searcher/pull/268), but it has not yet been merged or released as a tagged version at time of analysis - this is 'upstream fix available (PR/commit); released patched version not independently confirmed.' Organizations using deep-searcher should monitor PR #268 for merge and apply the patched commit or cherry-pick the changes manually. As a compensating control, operators can restrict access to the deep-searcher API surface to trusted, fully-authorized users only, avoiding multi-tenant deployment until the patch is released. Alternatively, embedding authorization logic at the application layer - passing explicit authorized_collection_set kwargs as introduced by the PR - provides collection-level isolation without waiting for the official release, but this requires modifying calling code. Note: the fix implements opt-in authorization (returns all collections when no authorized set is supplied), so callers must actively pass authorized_collection_set for the control to take effect.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today