Description
A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3d932f1c3e065351c4440c27abe1e6479752544d. Applying a patch is the recommended action to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| milvus-io | milvus | 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/milvus-io/milvus | < 0.10.3-0.20260602041816-3d932f1c3e06 | 0.10.3-0.20260602041816-3d932f1c3e06 | GHSA-jh6h-v6mp-h22v |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
References
- VDB-368262 | milvus-io milvus Grantee ID Hash kv_catalog.go weak hash vdb-entry
- VDB-368262 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-10814 | CVE Analysis and Report third-party-advisory
- Submit #831645 | Milvus v2.6.13 Authorization Bypass` / `Hash Collision` / `Privilege Escalation third-party-advisory
- https://github.com/milvus-io/milvus/issues/49857 exploit issue-tracking
- https://github.com/milvus-io/milvus/pull/50060 issue-tracking patch
- https://github.com/milvus-io/milvus/commit/3d932f1c3e065351c4440c27abe1e6479752544d patch
- https://github.com/milvus-io/milvus/ product