CVE-2026-26190: github.com/milvus-io/milvus < 2.5.27, >= 2.6.0, < 2.6.10

CVE-2026-26190 affects github.com/milvus-io/milvus. CVSS 3.1 base score 9.8 (GitHub Advisory Database). EPSS 0.0456 (percentile 0.91545), scored 21-Oct-2026. Affected range: < 2.5.27. Fixed version: 2.5.27. Affected range: >= 2.6.0, < 2.6.10. Fixed version: 2.6.10.

Affected technology

github.com/milvus-io/milvus · < 2.5.27
Vendor not specified by the source

github.com/milvus-io/milvus · >= 2.6.0, < 2.6.10
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (GitHub Advisory Database, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could get past authentication checks. GitHub Advisory Database’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.

Published 22-Oct-2026 20:58 UTC

Product: github.com/milvus-io/milvus
CCR priority: 40.3 /100 (P3)
CVSS 3.1: 9.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · GitHub Advisory Database
EPSS: 0.0456 · percentile 0.91545 · 2026-10-21
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-22 20:55:42.144132+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-26190.html