PT-2026-47197 · Zilliztech · Deep-Searcher

Dem000 · Published 2026-06-07 · Updated 2026-06-07 · CVE-2026-11466

Mitre

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collection router.py. This manipulation of the argument kwargs causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Exploit

Fix

Incorrect Privilege Assignment

Improper Access Control

Weakness Enumeration

CWE-266

CWE-284

Related Identifiers

CVE-2026-11466

Affected Products

Deep-Searcher

References · 8

• 🔥 https://github.com/zilliztech/deep-searcher/issues/267 · Exploit
• https://github.com/zilliztech/deep-searcher/pull/268 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-11466 · Security Note
• https://github.com/zilliztech/deep-searcher · Note
• https://vuldb.com/vuln/369086/cti · Note
• https://vuldb.com/cve/CVE-2026-11466 · Note
• https://vuldb.com/vuln/369086 · Note
• https://vuldb.com/submit/833652 · Note