critical vulnerability

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

Fix availableCritical · CVSS 9.8EPSS 4.6%

Published Feb 11, 2026 · updated Oct 22, 2026

What to do

Upgrade to a fixed version: github.com/milvus-io/milvus 2.5.27, github.com/milvus-io/milvus 2.6.10.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/milvus-io/milvus

Vulnerable versions: < 2.5.27
Fixed in: 2.5.27

Check your project: go list -m all | grep github.com/milvus-io/milvus

Gogithub.com/milvus-io/milvus

Vulnerable versions: >= 2.6.0, < 2.6.10
Fixed in: 2.6.10

Check your project: go list -m all | grep github.com/milvus-io/milvus

Sources

GitHub Advisory GHSA-7ppg-37fh-vcr6
NVD CVE-2026-26190

CWE-306 Missing Authentication for Critical Function · CWE-749 Exposed Dangerous Method or Function · CWE-1188 Initialization of a Resource with an Insecure Default

← All critical vulnerabilities