Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

🗓️ 11 Feb 2026 19:49:44Reported by GitHub Advisory DatabaseType

Milvus exposes port 9091 with unauthenticated REST API and weak /expr token.

Reporter	Title	Published	Views	Family All 117
Circl	CVE-2026-26190	11 Feb 202611:40	–	circl
CNNVD	milvus 访问控制错误漏洞	13 Feb 202600:00	–	cnnvd
CVE	CVE-2026-26190	13 Feb 202618:44	–	cve
Cvelist	CVE-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	13 Feb 202618:44	–	cvelist
Nuclei	Milvus - Unauthenticated Metrics API Access	8 Jun 202605:45	–	nuclei
NVD	CVE-2026-26190	13 Feb 202619:17	–	nvd
OSV	BIT-MILVUS-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	19 Feb 202608:47	–	osv
OSV	CVE-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	13 Feb 202618:44	–	osv
OSV	GHSA-7PPG-37FH-VCR6 Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise	11 Feb 202619:49	–	osv
OSV	GO-2026-4481 Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise in github.com/milvus-io/milvus	17 Feb 202618:09	–	osv

Vulners

Node

milvus-io milvusRange2.6.0–2.6.10go

Source	Link
github	www.github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6
github	www.github.com/milvus-io/milvus/releases/tag/v2.5.27
github	www.github.com/milvus-io/milvus/releases/tag/v2.6.10
github	www.github.com/advisories/GHSA-7ppg-37fh-vcr6

24 Feb 2026 14:24Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.8

EPSS0.005

SSVC