CVE-2026-105049 PUBLISHED

Assigner: mitre
Reserved: 02.10.2026 Published: 02.10.2026 Updated: 02.10.2026

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS Score: 5.8

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Zilliz
Product	Attu
Versions	Default: unaffected affected from 2.6.5 to 3.0.0 (excl.) unknown from 0 to 2.6.5 (excl.)

References

https://bishopfox.com/blog/zilliz-attu-2-6-5
https://github.com/zilliztech/attu/issues/1028

Problem Types

CWE-306 Missing Authentication for Critical Function CWE