CVE-2026-11466 Overview
CVE-2026-11466 is an improper access control vulnerability [CWE-266] in the zilliztech deep-searcher project, affecting versions up to 0.0.2. The flaw resides in the CollectionRouter.invoke function within deepsearcher/agent/collection_router.py. Attackers can manipulate the kwargs argument to bypass intended access restrictions. The issue is exploitable remotely over the network and requires low privileges. Public details and a proof-of-concept have been disclosed, while the pull request providing the fix remains pending acceptance upstream.
Critical Impact
Remote authenticated attackers can manipulate kwargs passed to CollectionRouter.invoke to bypass access controls within the deep-searcher agent routing layer.
Affected Products
- zilliztech deep-searcher version 0.0.0
- zilliztech deep-searcher version 0.0.1
- zilliztech deep-searcher version 0.0.2
Discovery Timeline
- 2026-06-07 - CVE-2026-11466 published to the National Vulnerability Database (NVD)
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11466
Vulnerability Analysis
The vulnerability is located in deepsearcher/agent/collection_router.py, specifically within the CollectionRouter.invoke method. This function accepts a kwargs parameter that is used to route requests across collections handled by the agent. The implementation does not adequately validate or restrict the contents of kwargs, allowing a remote caller to influence routing decisions and reach collections or operations that should be inaccessible.
Classified under [CWE-266] (Incorrect Privilege Assignment), the weakness allows a low-privileged user to exercise privileges beyond their intended scope. Because the agent layer typically mediates access to backend vector stores and search collections, the bypass undermines the application's authorization boundary.
The vulnerability is network-exploitable with low attack complexity. No user interaction is required, but the attacker must hold low-level privileges on the target instance. Exploitation impacts confidentiality and availability at a limited level, with no direct impact to integrity according to the published CVSS 4.0 vector.
Root Cause
The root cause is insufficient validation of caller-controlled keyword arguments within CollectionRouter.invoke. The function trusts attributes supplied through kwargs to make routing decisions without enforcing privilege checks against the requesting principal. This permits parameter manipulation to influence which collections are queried or invoked.
Attack Vector
A remote, authenticated attacker sends crafted requests to an endpoint that invokes CollectionRouter.invoke. By supplying attacker-controlled values in kwargs, the attacker steers the router toward collections or operations outside their intended access scope. The exploit is publicly documented in VulDB CVE-2026-11466 and tracked in GitHub Issue #267.
No verified exploit code is reproduced here. Refer to the GitHub Pull Request #268 for the proposed fix and the issue tracker for technical reproduction details.
Detection Methods for CVE-2026-11466
Indicators of Compromise
- Unexpected invocations of CollectionRouter.invoke containing unusual or unauthorized keys within the kwargs payload.
- Application logs showing access to vector collections that fall outside a given user's authorization scope.
- Repeated requests from a single authenticated principal probing different kwargs parameter combinations.
Detection Strategies
- Instrument deepsearcher/agent/collection_router.py to log the principal, target collection, and full kwargs set on every invocation.
- Compare runtime routing decisions against an expected allow-list of collections per role to surface deviations.
- Review API gateway logs for clients submitting unexpected keyword parameters to deep-searcher endpoints.
Monitoring Recommendations
- Forward deep-searcher application logs to a centralized analytics platform and alert on access-control denial patterns followed by successful access.
- Track baseline counts of distinct kwargs keys per user and alert on statistical anomalies.
- Monitor outbound queries from the agent to backend vector stores for collections never previously accessed by the calling identity.
How to Mitigate CVE-2026-11466
Immediate Actions Required
- Restrict network access to deep-searcher deployments so only trusted clients can reach the agent endpoints exposing CollectionRouter.invoke.
- Audit existing accounts with access to the agent and remove low-privilege accounts that do not require routing capabilities.
- Review recent application logs for evidence of kwargs manipulation against the router function.
Patch Information
No accepted upstream patch is available at the time of disclosure. The proposed fix is tracked in GitHub Pull Request #268 and references GitHub Issue #267. Operators should monitor the DeepSearcher repository for merge status and apply the patched release once published.
Workarounds
- Place deep-searcher behind a reverse proxy that strips or whitelists permitted keyword parameters before they reach CollectionRouter.invoke.
- Apply a local downstream patch mirroring the change in Pull Request #268 until an official release is available.
- Enforce authorization checks at the application layer to validate that the calling principal is permitted to access the resolved target collection.
# Configuration example: restrict deep-searcher network exposure via firewall
# Allow only the internal application tier to reach the agent port
iptables -A INPUT -p tcp --dport 8000 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
