Vulnerability Report

CVE-2026-26190

Title: Authentication bypass and unauthenticated API access in Milvus

Auth Bypass

Proof Of Concept

PoC Available for CVE-2026-26190

CWE Category CWE-306

Published Date Feb 13, 2026

Modified Date Feb 18, 2026

Exploit Status Available

Score 9.8 CVSS v3.1

Exploit Probability (EPSS)

36.91%

Vulnerability Summary

CVE-2026-26190: Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.

Impacted Vendors

milvus 1

Reference Links

https://github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9 https://github.com/milvus-io/milvus/releases/tag/v2.5.27 https://github.com/milvus-io/milvus/releases/tag/v2.6.10 https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-26190 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/qianlijaingshan/milvus-auth-audit

View Code

February 18, 2026 MODIFIED

Vulnerability data updated via NVD.

February 18, 2026 MODIFIED

Vulnerability data updated via NVD.

February 13, 2026 MODIFIED

Vulnerability data updated via NVD.

February 13, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.