CVE-2026-105049

MediumCVSS 5.8

Published: 02/10/2026(UTC)Translated: 03/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.

Risk Assessment

An unauthenticated attacker can exploit this feature to make requests on behalf of the server, potentially leading to abuse and security breaches.

Recommendation

Upgrade Zilliz Attu to version 3.0.0 or later that includes the fix. Restrict access to the Playground feature and require authentication.

Other vulnerabilities in Zilliz Attu

CVE-2026-105048Medium
The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).

Original NVD description (English source)

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS