CVE-2026-26190

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.

• CWE-306

• https://github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9Patch
• https://github.com/milvus-io/milvus/releases/tag/v2.5.27Product, Release Notes
• https://github.com/milvus-io/milvus/releases/tag/v2.6.10Product, Release Notes
• https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6Exploit, Mitigation, Vendor Advisory

Published

Feb 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26185Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2026-26186Fleet is open source device management software. A SQL injec…8.8
• CVE-2026-26187lakeFS is an open-source tool that transforms object storage…8.1
• CVE-2026-26188Solspace Freeform plugin for Craft CMS 5.x is a super flexib…5.4
• CVE-2026-26189Trivy Action runs Trivy as GitHub action to scan a Docker co…8.1
• CVE-2026-2619GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-26191Fleet is open source device management software. Prior to ve…9.8
• CVE-2026-26192Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-26193Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-26194Gogs is an open source self-hosted Git service. Prior to ver…7.3
• CVE-2026-26195Gogs is an open source self-hosted Git service. Prior to ver…6.1
• CVE-2026-26196Gogs is an open source self-hosted Git service. Prior to ver…5.3