Furthermore, CVE-2026-26190 affects two other components: the /expr debug endpoint on management port 9091, which utilizes a weak, predictable default authentication token ('by-dev'), and the lack of authentication on the internal gRPC port 53100. These flaws allow arbitrary expression execution and unauthorized database access. While newer versions (2.6.10+) mitigate these by disabling the /expr endpoint by default and closing internal port 53100, existing unpatched instances remain at high risk.

Attack Chain

1. Attacker performs network reconnaissance to identify exposed Milvus management (9091) or proxy (19530) ports.
2. Attacker crafts a gRPC request or HTTP request targeting the proxy port (19530).
3. Attacker injects the 'sourceId' header with the value '@@milvus-member@@' to trigger the authentication interceptor bypass (CVE-2025-64513).
4. Attacker provides authorization credentials formatted as base64 'root:fake_password' to masquerade as an administrator.
5. Attacker gains full administrative access to the Milvus proxy.
6. Alternatively, the attacker targets port 9091 and authenticates to the /expr endpoint using the default token 'by-dev' (CVE-2026-26190).
7. Attacker submits malicious 'expr-lang' expressions through the /expr endpoint to achieve arbitrary code execution.
8. Attacker executes database queries or administrative commands to exfiltrate or manipulate stored vector data.

Impact

Successful exploitation grants an attacker full administrative control over the Milvus database instance. This impact includes the potential for total data exfiltration, database manipulation, and further compromise of the underlying infrastructure hosting the Milvus service. As a vector database, Milvus often stores critical AI/ML embeddings and intellectual property, making it a high-value target for threat actors.

Recommendation

• Upgrade all Milvus deployments to version 2.6.10 or later immediately to patch CVE-2025-64513 and CVE-2026-26190.
• Implement network-level access control lists (ACLs) to restrict access to ports 19530, 9091, and 53100 to known trusted internal IP addresses only.
• Monitor logs for unusual authentication headers or high-frequency requests to the /expr debug endpoint.
• If upgrading is not immediately possible, explicitly disable the /expr endpoint by setting common.security.exprEnabled to false in the Milvus configuration.