CVE-2026-26190
Critical · 9.8CVSS
9.8
EPSS
4.6%
Published
Feb 13, 2026
CISA due date
—
The record
Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/milvus-io/milvus | 0 | 2.5.27 |
| Go | github.com/milvus-io/milvus | 0 | No fix |
| Go | github.com/milvus-io/milvus | 2.6.0 | 2.6.10 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4481 Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical… Same vulnerability
- GO-2025-4114 Milvus Proxy has a Critical Authentication Bypass Vulnerability in… Also affects github.com/milvus-io/milvus
- CVE-2025-64513 Milvus is an open-source vector database built for generative AI applications. Also affects github.com/milvus-io/milvus
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb