{"id":"CVE-2026-26190","aliases":["BIT-milvus-2026-26190","GHSA-7ppg-37fh-vcr6","GO-2026-4481"],"url":"https://o3.security/vulnerability/CVE-2026-26190","summary":"Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise","details":"Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.","published":"2026-02-13T18:44:33.465Z","modified":"2026-07-31T18:31:33.113992727Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/milvus-io/milvus","fixedVersion":"2.5.27"},{"ecosystem":"Go","name":"github.com/milvus-io/milvus","fixedVersion":"2.6.10"}],"fix":{"url":"https://github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9","label":"milvus-io/milvus@92b74dd"},"references":[{"type":"WEB","url":"https://github.com/milvus-io/milvus/releases/tag/v2.5.27"},{"type":"WEB","url":"https://github.com/milvus-io/milvus/releases/tag/v2.6.10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26190.json"},{"type":"ADVISORY","url":"https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26190"},{"type":"FIX","url":"https://github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-31T18:31:33.113992727Z"}}