Threat database

Zilliz Attu versions from 2.6.5 up to but not including 3.0.0 contain a vulnerability in the Playground feature that allows proxying arbitrary HTTP and HTTPS requests without requiring authentication. This missing authentication for a critical function could allow unauthorized users to misuse the proxy capability. The vulnerability has a medium severity with a CVSS score of 5.8.

Zilliz Attu versions from 2.6.5 up to but not including 3.0.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the Playground feature. This vulnerability arises from improper validation of unsafe equivalence in input, allowing proxying of requests to private IP addresses. The CVSS 3.1 base score is 4.0, indicating medium severity. There is no indication of active exploitation in the wild. No official patch or remediation details are provided in the available data.

CVE-2026-11466 is a medium severity vulnerability in zilliztech deep-searcher versions 0.0.1 and 0.0.2. It involves improper access controls in the CollectionRouter.invoke function, allowing remote attackers to manipulate arguments and potentially bypass access restrictions. A fix has been proposed but is not yet accepted or released. No known exploits are currently in the wild.

CVE-2026-10812 is a low-severity vulnerability in zilliztech GPTCache up to version 0.1.44. It involves the use of a weak hash function in the BufferedReader.peek function within the Cache Key Handler component. Exploitation requires local access and is considered highly complex and difficult. A fix has been proposed but is not yet accepted or officially released.