CVE-2026-10814CWE-327CWE-328

milvus-io milvus Grantee ID Hash kv_catalog.go weak hash

Low · published June 4, 2026

CVSS v4.0
2.0
EPSS
0%
Percentile
0.4
In the wild
Unconfirmed
What it is

A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3d932f1c3e065351c4440c27abe1e6479752544d. Applying a patch is the recommended action to fix this issue.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00089 · 0.4th percentile
Weaknesses
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm; CWE-328 · Use of Weak Hash
Published
2026-06-04T15:00Z
EPSS history
Timeline
  • 04 JUN 15:00Z
    milvus-io milvus Grantee ID Hash kv_catalog.go weak hash
    cvelistv5