{"id":"GO-2026-5999","summary":"milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery in github.com/milvus-io/milvus","details":"milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery in github.com/milvus-io/milvus","aliases":["BIT-milvus-2026-10814","CVE-2026-10814","GHSA-jh6h-v6mp-h22v"],"modified":"2026-07-21T19:19:03.619716107Z","published":"2026-07-17T19:42:05Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5999","review_status":"UNREVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jh6h-v6mp-h22v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10814"},{"type":"FIX","url":"https://github.com/milvus-io/milvus/commit/3d932f1c3e065351c4440c27abe1e6479752544d"},{"type":"FIX","url":"https://github.com/milvus-io/milvus/pull/50060"},{"type":"REPORT","url":"https://github.com/milvus-io/milvus/issues/49857"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-10814"},{"type":"WEB","url":"https://vuldb.com/submit/831645"},{"type":"WEB","url":"https://vuldb.com/vuln/368262"},{"type":"WEB","url":"https://vuldb.com/vuln/368262/cti"}],"affected":[{"package":{"name":"github.com/milvus-io/milvus","ecosystem":"Go","purl":"pkg:golang/github.com/milvus-io/milvus"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.3-0.20260602041816-3d932f1c3e06"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5999.json"}}],"schema_version":"1.7.5"}