Medium · 5.8 CVE-2026-105049 EUVD-2026-91837GHSA-4xhx-g43j-j7vj

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to UR…

Published Oct 2, 2026 · Updated Oct 5, 2026 · Assigned by mitre

Description

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.

Affected products

Vendor	Product	Affected	Fixed
Zilliz	Attu	2.6.5 – < 3.0.0	3.0.0

References

https://bishopfox.com/blog/zilliz-attu-2-6-5 third-party-advisory
https://github.com/zilliztech/attu/issues/1028 issue-tracking