CVE-2026-10814: milvus-io milvus Grantee ID Hash kv_catalog.go weak hash
A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kvcatalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3d932f1c3e065351c4440c27abe1e6479752544d. Applying a patch is the recommended action to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
milvus-io milvusto a version that resolves this vulnerability.Fixed in 2.6.13Patch 3d932f1c3e065351c4440c27abe1e6479752544d - Compensating control
Given the vulnerability allows use of weak hash and exploitation requires local attack with high complexity, restrict local access to the Milvus host(s) (e.g., limit who can run code/commands on nodes) to reduce the likelihood of exploitation of internal/metastore/kv/rootcoord/kv_catalog.go (Grantee ID Hash Handler).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10814?
The severity of CVE-2026-10814 is rated as medium with a score of 4.5.
How do I fix CVE-2026-10814?
To fix CVE-2026-10814, upgrade milvus-io Milvus to version 2.6.14 or later.
What component is affected by CVE-2026-10814?
CVE-2026-10814 affects the Grantee ID Hash Handler within the file kv_catalog.go.
What type of vulnerability is CVE-2026-10814?
CVE-2026-10814 is a vulnerability associated with the use of a weak hash.
What are the attack requirements for CVE-2026-10814?
An attacker must perform the attack locally to exploit CVE-2026-10814.