Milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and…
Milvus
More for Milvus RSS feed for Milvus
- Severity
- High, CVSS 7.0
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-10814
- Affects
- Milvus
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 4, 2026
- Source last modified
- July 22, 2026
Description
A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3d932f1c3e065351c4440c27abe1e6479752544d. Applying a patch is the recommended action to fix this issue.
Description quoted from the NVD record.
Who is affected
Milvus is a database that AI tools use to store and search large amounts of data. This flaw affects Milvus versions up to and including 2.6.13. The problem is in the part of the product that keeps track of which users have been given which permissions: it uses a weak method to label those permission assignments. An attacker would need local access to the system running Milvus, and the attack is difficult to carry out. This flaw is rated High.
What to do
- The person who installed or runs Milvus for your organization should handle this. If an IT provider or vendor manages it for you, they should handle it.
- Check which version of Milvus you run. Version 2.6.13 and all earlier versions are affected.
- No fixed version is named for this flaw yet. The recommended fix is to apply the patch for this flaw, so check the vendor advisory linked on this page for a fixed release or patch and install it.
- If an IT provider or vendor runs Milvus for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of July 22, 2026 and reviewed before publishing.