CVE-2026-26190: Milvus Authentication Bypass Vulnerability

CVE-2026-26190 Overview

CVE-2026-26190 is a critical authentication bypass vulnerability affecting Milvus, an open-source vector database built for generative AI applications. The vulnerability exists because Milvus exposes TCP port 9091 by default, which enables multiple authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. Additionally, the full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management.

Critical Impact

Attackers can bypass authentication entirely to gain full access to the Milvus vector database, manipulate data, and manage credentials without any authorization, potentially compromising AI/ML workloads and sensitive data stored in the database.

Affected Products

• Milvus versions prior to 2.5.27
• Milvus versions prior to 2.6.10

Discovery Timeline

• 2026-02-13 - CVE-2026-26190 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-26190

Vulnerability Analysis

This vulnerability represents a Missing Authentication for Critical Function weakness (CWE-306). The root issue stems from architectural decisions that exposed sensitive administrative and operational endpoints without proper authentication controls. Milvus, designed for managing vector embeddings in AI applications, inadvertently left critical pathways accessible to unauthenticated attackers through its default network configuration.

The vulnerability manifests through two distinct attack surfaces. First, the /expr debug endpoint accepts a predictable authentication token based on the etcd.rootPath configuration value, which defaults to by-dev. This weak token mechanism allows attackers who understand the default configuration to authenticate and execute arbitrary expressions. Second, and more severely, the entire REST API (/api/v1/*) is bound to the metrics/management port (9091) without implementing any authentication checks whatsoever.

Root Cause

The vulnerability originates from the registration of business-critical API endpoints on a port intended for metrics and management purposes. The design assumed this port would be isolated from untrusted networks, but the default configuration exposes it to network access. Additionally, the debug endpoint's authentication mechanism relies on a static, easily guessable token derived from a well-known configuration default rather than implementing cryptographically secure authentication.

Attack Vector

Exploitation requires network access to TCP port 9091 on the Milvus server. An attacker can leverage this vulnerability through a network-based attack without requiring any privileges or user interaction. The attack surface includes:

The vulnerability allows unauthenticated access through the management port. Attackers can interact with the REST API endpoints to perform data manipulation operations, access stored vector embeddings and metadata, modify or delete collections, and potentially extract or manipulate credentials managed by the database. The predictable token on the /expr endpoint enables arbitrary expression evaluation, which could lead to further exploitation depending on the expression evaluation capabilities.

Detection Methods for CVE-2026-26190

Indicators of Compromise

• Unexpected network connections to port 9091 from untrusted IP addresses
• Access logs showing requests to /api/v1/* endpoints from unauthorized sources
• Requests to the /expr debug endpoint, especially with the default by-dev derived token
• Unusual data manipulation or credential management API calls
• Modifications to collections or credentials without corresponding authorized user activity

Detection Strategies

• Monitor network traffic to port 9091 for connections originating outside trusted network segments
• Implement API access logging and alerting for all requests to the management port endpoints
• Review authentication logs for attempts using the default by-dev token pattern
• Deploy intrusion detection rules to flag unauthorized REST API access patterns

Monitoring Recommendations

• Configure network segmentation monitoring to alert on any external access to port 9091
• Enable verbose logging on the Milvus management interface to capture all API requests
• Set up anomaly detection for unusual query patterns or bulk data operations
• Monitor for changes to credential configurations or user management operations

How to Mitigate CVE-2026-26190

Immediate Actions Required

• Upgrade Milvus to version 2.5.27 or 2.6.10 immediately to patch this vulnerability
• Restrict network access to port 9091 using firewall rules to allow only trusted management hosts
• Review access logs for any signs of exploitation or unauthorized access to the management API
• Audit any credential or data changes that may have occurred if exposure is suspected

Patch Information

Milvus has released security patches addressing this authentication bypass vulnerability. The fixes are available in versions 2.5.27 and 2.6.10. Organizations should upgrade to one of these versions based on their deployment branch. The security fix can be reviewed in the GitHub commit 92b74dd2e286006a83b4a5f07951027b32e718a9. For detailed information about the vulnerability, refer to the GitHub Security Advisory GHSA-7ppg-37fh-vcr6.

Workarounds

• Implement network-level access controls to restrict port 9091 to trusted IP ranges only
• Deploy a reverse proxy with authentication in front of the management port if upgrades cannot be performed immediately
• Disable or block the /expr debug endpoint through configuration if not required for operations
• Consider deploying Milvus behind a VPN or private network segment to limit exposure

# Example firewall configuration to restrict access to port 9091
# Allow only trusted management network (replace with your actual IP range)
iptables -A INPUT -p tcp --dport 9091 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9091 -j DROP