PT-2026-46252 · Milvus Io · Milvus

Dem00 · CVE-2026-10814 · Published 2026-06-04 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions milvus-io milvus versions prior to 2.6.14

Description An issue exists in the Grantee ID Hash Handler component within the file internal/metastore/kv/rootcoord/kv catalog.go. This flaw allows for the use of a weak hash, which can be manipulated. Exploitation requires local access and is characterized by high complexity and difficult exploitability.

Recommendations Apply patch 3d932f1c3e065351c4440c27abe1e6479752544d to resolve the issue.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-328

CWE-327

Related Identifiers

BIT-MILVUS-2026-10814

CVE-2026-10814

GHSA-JH6H-V6MP-H22V

GO-2026-5999

OPENSUSE-SU-2026:21483-1

Affected Products

Milvus

References · 1750

• 🔥 https://github.com/milvus-io/milvus/issues/49857 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10814.json · Exploit
• https://github.com/milvus-io/milvus/commit/3d932f1c3e065351c4440c27abe1e6479752544d · Patch
• https://github.com/milvus-io/milvus/pull/50060 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10814 · Security Note
• https://osv.dev/vulnerability/GHSA-jh6h-v6mp-h22v · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5999 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-milvus-2026-10814 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-10814 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/milvus-io/milvus · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note