Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/milvus-io/milvus

3 known vulnerabilities (2 critical, 1 low), with the versions each affects and the releases that fix them.

Latest release
v1.1.1 (Jun 16, 2021): affected by 2 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
3 · 2 critical, 1 low
Releases
21 since v0.5.1 (Nov 4, 2019)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-10814
    Affects v0.5.1 to v0.10.2 (v0.10.3 is outside it)
  • CVE-2026-26190
    Affects v0.5.1 to v1.1.1 (through the newest release)
  • CVE-2025-64513
    Affects v0.5.1 to v0.10.2 (v0.10.3 is outside it); v0.10.4 to v1.1.1 (through the newest release)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • milvus-io milvus Grantee ID Hash kv_catalog.go weak hash

    Affected: fixed in 0.10.3-0.20260602041816-3d932f1c3e06.

    Fixed in v0.10.3 (released Sep 17, 2020, 2086 days before disclosure, the advisory names 0.10.3-0.20260602041816-3d932f1c3e06, which was never published).

    The latest release, v1.1.1, is not affected.

  • CVE-2026-26190Critical 9.8

    Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

    Affected: all versions; fixed in 2.5.27; from 2.6.0, fixed in 2.6.10.

    No fix released. The latest release, v1.1.1, is still affected.

  • CVE-2025-64513Critical 9.3

    Milvus Proxy has Critical Authentication Bypass Vulnerability

    Affected: from 0.10.4, fixed in 2.4.24; from 2.5.0, fixed in 2.5.21; from 2.6.0, fixed in 2.6.5; fixed in 0.10.3-0.20251107071934-6102f001a971; fixed in 0.10.3-0.20251107071934-6102f001a971; from 0.10.4.

    Fixed in v0.10.3 (released Sep 17, 2020, 1880 days before disclosure, the advisory names 0.10.3-0.20251107071934-6102f001a971, which was never published).

    The latest release, v1.1.1, is still affected.