{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/milvus-io/milvus","cve_ids":["CVE-2026-26190"],"ecosystem":"Go","epss":0.0456,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7ppg-37fh-vcr6","id":"tcs_01M5KGDZZ5EAWCSKXBS8AF03NG","modified_at":"2026-02-19T20:41:22.616563Z","published_at":"2026-02-17T18:09:06Z","references":["https://osv.dev/vulnerability/GO-2026-4481","https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6","https://github.com/milvus-io/milvus/releases/tag/v2.5.27","https://github.com/milvus-io/milvus/releases/tag/v2.6.10"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4481","url":"https://osv.dev/vulnerability/GO-2026-4481"}],"summary":"Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise in github.com/milvus-io/milvus"}