CVE-2026-105049 - Vulnerability Details - OpenCVE

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Zilliz	Attu

No data.

No data.

References

Link	Providers
https://bishopfox.com/blog/zilliz-attu-2-6-5
https://github.com/zilliztech/attu/issues/1028

History

Mon, 05 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 04 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zilliz Zilliz attu
Vendors & Products		Zilliz Zilliz attu

Fri, 02 Oct 2026 23:45:00 +0000

Type	Values Removed	Values Added
Title		Unauthenticated Proxying via Zilliz Attu Playground

Fri, 02 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Description		Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.
Weaknesses		CWE-306
References		https://bishopfox.com/blog/zilliz-attu-2-6-5 https://github.com/zilliztech/attu/issues/1028
Metrics		cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-10-02T22:14:36.181Z

Updated: 2026-10-05T17:11:48.421Z

Reserved: 2026-10-02T22:14:35.487Z

Link: CVE-2026-105049

Vulnrichment

Updated: 2026-10-05T17:11:43.858Z

NVD

Status : Awaiting Analysis

Published: 2026-10-02T23:16:57.943

Modified: 2026-10-06T16:08:27.613

Link: CVE-2026-105049

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105049", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-02T22:14:35.487Z", "datePublished": "2026-10-02T22:14:36.181Z", "dateUpdated": "2026-10-05T17:11:48.421Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Playground"], "product": "Attu", "repo": "https://github.com/zilliztech/attu", "vendor": "Zilliz", "versions": [{"lessThan": "3.0.0", "status": "affected", "version": "2.6.5", "versionType": "semver"}, {"lessThan": "2.6.5", "status": "unknown", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-02T22:14:36.181Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://bishopfox.com/blog/zilliz-attu-2-6-5"}, {"tags": ["issue-tracking"], "url": "https://github.com/zilliztech/attu/issues/1028"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T17:10:37.840163Z", "id": "CVE-2026-105049", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T17:11:48.421Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-105049", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T17:10:37.840163Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T17:11:43.858Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/zilliztech/attu", "vendor": "Zilliz", "modules": ["Playground"], "product": "Attu", "versions": [{"status": "affected", "version": "2.6.5", "lessThan": "3.0.0", "versionType": "semver"}, {"status": "unknown", "version": "0", "lessThan": "2.6.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bishopfox.com/blog/zilliz-attu-2-6-5", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zilliztech/attu/issues/1028", "tags": ["issue-tracking"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-02T22:14:36.181Z"}}}, "cveMetadata": {"cveId": "CVE-2026-105049", "state": "PUBLISHED", "dateUpdated": "2026-10-05T17:11:48.421Z", "dateReserved": "2026-10-02T22:14:35.487Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-02T22:14:36.181Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}