« Volver al listado

CVE-2026-26190

Estado: AnalizadaCrítica (9.8)—

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/AC:L/PR:N/UI:N indica red sin autenticación (T1190). El puerto 9091 expuesto sin validación permite bypass de autenticación (T1078), manipulación de datos (T1565) y lectura de base de datos vectorial (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser Training

Tecnologías afectadas (1)

Milvus — Milvus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-26190",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-26190",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-18T04:56:24.717605Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "milvus-io",
          "product": "milvus",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.5.27"
            },
            {
              "status": "affected",
              "version": ">= 2.6.0, < 2.6.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-13T19:17:29.253",
  "references": [
    {
      "url": "https://github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/milvus-io/milvus/releases/tag/v2.5.27",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/milvus-io/milvus/releases/tag/v2.6.10",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10."
    },
    {
      "lang": "es",
      "value": "Milvus es una base de datos vectorial de código abierto construida para aplicaciones de IA generativa. Antes de 2.5.27 y 2.6.10, Milvus expone el puerto TCP 9091 por defecto, lo que permite eludir la autenticación. El endpoint de depuración /expr utiliza un token de autenticación predeterminado débil y predecible derivado de etcd.rootPath (por defecto: by-dev), lo que permite la evaluación arbitraria de expresiones. La API REST completa (/api/v1/*) está registrada en el puerto de métricas/gestión sin ninguna autenticación, lo que permite el acceso no autenticado a todas las operaciones comerciales, incluida la manipulación de datos y la gestión de credenciales. Esta vulnerabilidad se corrige en 2.5.27 y 2.6.10."
    }
  ],
  "lastModified": "2026-06-17T10:25:54.857",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:milvus:milvus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47F8F103-3983-4099-A154-D8F4A04A1EA5",
              "versionEndExcluding": "2.5.27"
            },
            {
              "criteria": "cpe:2.3:a:milvus:milvus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34DA261B-809B-41E7-A1AA-486B04758216",
              "versionEndExcluding": "2.6.10",
              "versionStartIncluding": "2.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}