CVE-2026-26190

🗓️ 13 Feb 2026 18:44:33Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 31 Views🌐 WEB

Milvus exposes port 9091 enabling unauthenticated access to all operations; fixed in 2.5.27 and 2.6.10.

Reporter	Title	Published	Views	Family All 20
Circl	CVE-2026-26190	11 Feb 202611:40	–	circl
CNNVD	milvus 访问控制错误漏洞	13 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	13 Feb 202618:44	–	cvelist
Github Security Blog	Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	11 Feb 202619:49	–	github
Nuclei	Milvus - Unauthenticated Metrics API Access	1 Aug 202610:03	–	nuclei
NVD	CVE-2026-26190	13 Feb 202619:17	–	nvd
OSV	BIT-MILVUS-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	19 Feb 202608:47	–	osv
OSV	CVE-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	13 Feb 202618:44	–	osv
OSV	GHSA-7PPG-37FH-VCR6 Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	11 Feb 202619:49	–	osv
OSV	GO-2026-4481 Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise in github.com/milvus-io/milvus	17 Feb 202618:09	–	osv

NVD

Vulners

Node

milvus milvusRange<2.5.27

milvus milvusRange2.6.0–2.6.10

[
  {
    "vendor": "milvus-io",
    "product": "milvus",
    "versions": [
      {
        "version": "< 2.5.27",
        "status": "affected"
      },
      {
        "version": ">= 2.6.0, < 2.6.10",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6
github	www.github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9
github	www.github.com/milvus-io/milvus/releases/tag/v2.6.10
github	www.github.com/milvus-io/milvus/releases/tag/v2.5.27

Parameter	Position	Path	Description	CWE
token	path	/expr	Debug endpoint '/expr' uses a weak/default authentication token derived from etcd.rootPath, allowing arbitrary expression evaluation.	CWE-306
authentication	path	/expr	Debug endpoint '/expr' uses a weak/default authentication token derived from etcd.rootPath, allowing arbitrary expression evaluation.	CWE-306
etcd.rootPath	path	/expr	Debug endpoint '/expr' uses a weak/default authentication token derived from etcd.rootPath, allowing arbitrary expression evaluation.	CWE-306
no authentication	path	/api/v1/*	Full REST API under '/api/v1/*' is registered on the metrics/management port without authentication, enabling unauthenticated access to all operations including data manipulation and credential management.	CWE-306
unauthenticated access	path	/api/v1/*	Full REST API under '/api/v1/*' is registered on the metrics/management port without authentication, enabling unauthenticated access to all operations including data manipulation and credential management.	CWE-306
credentials management	path	/api/v1/*	Full REST API under '/api/v1/*' is registered on the metrics/management port without authentication, enabling unauthenticated access to all operations including data manipulation and credential management.	CWE-306

17 Jun 2026 10:25Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.19.8

EPSS0.36912

SSVC

CWE-306