TI-2026-09282 Aliases CVE-2026-10814 GHSA-jh6h-v6mp-h22v

milvus-io milvus Grantee ID Hash kv_catalog.go weak hash

MEDIUM 44CWE-327Published 2026-06-04 · Updated 2026-06-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3d932f1c3e065351c4440c27abe1e6479752544d. Applying a patch is the recommended action to fix this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00089 0th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed github.com/milvus-io/milvus (Go): 0.10.3-0.20260602041816-3d932f1c3e06

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
milvus-io	milvus	2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; 2.6.6; 2.6.7; 2.6.8; 2.6.9; 2.6.10; 2.6.11; 2.6.12; 2.6.13	—	No fix listed	CNA
—	github.com/milvus-io/milvus (Go)	before 0.10.3-0.20260602041816-3d932f1c3e06	0.10.3-0.20260602041816-3d932f1c3e06	Patch available	GHSA-jh6h-v6mp-h22v

milvus Vendormilvus-io Affected 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; 2.6.6; 2.6.7; 2.6.8; 2.6.9; 2.6.10; 2.6.11; 2.6.12; 2.6.13 Fixed in — No fix listed CNA
github.com/milvus-io/milvus (Go) Vendor— Affected before 0.10.3-0.20260602041816-3d932f1c3e06 Fixed in 0.10.3-0.20260602041816-3d932f1c3e06 Patch available GHSA-jh6h-v6mp-h22v

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:milvus:milvus::::::::	up to 2.6.13	Vulnerable	Milvus

cpe:2.3:a:milvus:milvus:*:*:*:*:*:*:*:* Versions up to 2.6.13 Vulnerable ·Milvus

Remediation

Fix · GHSA-jh6h-v6mp-h22v github.com/milvus-io/milvus (Go) Fixed in 0.10.3-0.20260602041816-3d932f1c3e06 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-10814
2026-10-03 Alias added: GHSA-jh6h-v6mp-h22v

References

Exploit 1

https://github.com/milvus-io/milvus/issues/49857

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-10814

Other 2

TI-2026-48516 Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop CVSS 4.0HIGH 8.7
TI-2025-39904 Milvus Proxy has Critical Authentication Bypass Vulnerability CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences