CVE-2026-26190

CRITICALNuclei

Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-26190 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 13, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 18, 2026 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

milvus

Browse milvus / milvus
VulnCheckVersion data not supplied

milvus

Browse milvus-io / milvus
CVE List< 2.5.27affected
>= 2.6.0, < 2.6.10affected

github.com/milvus-io/milvus

Browse Go / github.com/milvus-io/milvus
GitHub AdvisoryBefore 2.5.27 · Fixed in 2.5.27affected
2.6.0 to < 2.6.10 · Fixed in 2.6.10affected

Proofs of concept

1

Repository PoCs

GitHubqianlijaingshan/milvus-auth-auditRepository PoCby qianlijaingshan0Scanner2 files

11.9 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that checks a Milvus instance for three authentication vulnerabilities (CVE-2025-64513, CVE-2026-26190, and an unauthenticated internal port) by sending gRPC and HTTP requests and reporting whether the target is vulnerable. It does not perform any post-exploitation actions.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python security audit script and its README. The script checks for three known Milvus authentication vulnerabilities (CVE-2025-64513, CVE-2026-26190, and an unauthenticated internal port) by sending crafted requests to a target Milvus instance. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The script's behavior is limited to the described vulnerability checks and does not perform any concealed or unrelated harmful actions.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareMilvus
Attack typesAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only sends detection probes (gRPC ListDatabases with and without the sourceid header, HTTP GET to /expr, and optional gRPC to the internal port) and reports whether the target is vulnerable. It does not perform any data modification, exfiltration, or administrative actions, which makes it a scanner rather than an exploit.

milvus-auth-audit.py:3-9milvus-auth-audit.py:78-113milvus-auth-audit.py:116-126milvus-auth-audit.py:129-148

Requirements

  • Network access to the target Milvus proxy gRPC port (default 19530) and management port (default 9091).milvus-auth-audit.py:15
  • Python dependencies grpcio and protobuf, plus compiled proto stubs in a proto/ subdirectory.README.md:31-32

Observed behavior

  • Sends an unauthenticated gRPC ListDatabases request to determine if authentication is enabled.milvus-auth-audit.py:55-75
  • Sends a gRPC ListDatabases request with a sourceid header containing the base64-encoded internal member credential to test CVE-2025-64513.milvus-auth-audit.py:78-113
  • Sends an HTTP GET request to /expr?code=1%2B1&auth=payload withheld on the management port to test CVE-2026-26190.milvus-auth-audit.py:116-126
  • Optionally sends an unauthenticated gRPC ListDatabases request directly to the internal rootcoord port (default 53100) to test for missing authentication.milvus-auth-audit.py:129-148
  • Prints a summary of which checks resulted in HIT, SAFE, or SKIP.milvus-auth-audit.py:195-205
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential
Payload withheldBase64-encoded sourceid payload used to test CVE-2025-64513 authentication bypass.milvus-auth-audit.py:30
Credential
Payload withheldDefault authentication token used to test CVE-2026-26190 /expr endpoint weak token vulnerability.milvus-auth-audit.py:31
Network Behavior
Payload withheldScript sends a ListDatabases request with a crafted sourceid header to test authentication bypass.milvus-auth-audit.py:102-103
Network Behavior
Payload withheldScript sends an HTTP request to the management port to test the /expr endpoint weak token vulnerability.milvus-auth-audit.py:118-119
Network Behavior
Payload withheldScript connects to the internal rootcoord port to test for unauthenticated access.milvus-auth-audit.py:137-139
Review boundaries

What the analysis did not establish

  • The evidence includes only the README and the Python script; the required compiled proto stubs (milvus_pb2_grpc.py, root_coord_pb2_grpc.py, etc.) are not provided, so the script cannot be executed as-is.
  • The script's behavior is inferred from source code analysis; no runtime output or network traffic is included in the evidence.
  • The review is based solely on the supplied text files (README.md and milvus-auth-audit.py). No binary files were present. The script's behavior when executed with specific arguments or against a live target was not tested; analysis is static only.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryCRITICALMilvus - Unauthenticated Metrics API AccessCVSS 9.8

Milvus < 2.5.27 and < 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091.

Impact

Attackers can bypass authentication to execute arbitrary expressions and manipulate data, risking full system compromise.

Remediation

Update to versions 2.5.27 or 2.6.10 or later.

WeaknessesCWE-306
AuthorsWRG-11
Template tagscvecve2026milvusauth-bypassunauth
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Shodan: http.html:"404 page not found" port:"9091"
https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6 https://github.com/advisories/GHSA-7ppg-37fh-vcr6 https://nvd.nist.gov/vuln/detail/CVE-2026-26190

Source: ProjectDiscovery

References

5