{"schema_version":"1.3.1","id":"GO-2026-5999","modified":"2026-07-17T19:42:05Z","published":"2026-07-17T19:42:05Z","aliases":["CVE-2026-10814","GHSA-jh6h-v6mp-h22v"],"summary":"milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery in github.com/milvus-io/milvus","details":"milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery in github.com/milvus-io/milvus","affected":[{"package":{"name":"github.com/milvus-io/milvus","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.3-0.20260602041816-3d932f1c3e06"}]}],"ecosystem_specific":{}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jh6h-v6mp-h22v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10814"},{"type":"FIX","url":"https://github.com/milvus-io/milvus/commit/3d932f1c3e065351c4440c27abe1e6479752544d"},{"type":"FIX","url":"https://github.com/milvus-io/milvus/pull/50060"},{"type":"REPORT","url":"https://github.com/milvus-io/milvus/issues/49857"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-10814"},{"type":"WEB","url":"https://vuldb.com/submit/831645"},{"type":"WEB","url":"https://vuldb.com/vuln/368262"},{"type":"WEB","url":"https://vuldb.com/vuln/368262/cti"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5999","review_status":"UNREVIEWED"}}