Unauthenticated Proxy Vulnerability in Zilliz Attu Product
CVE-2026-105049

5.8MEDIUM

Key Information:

Vendor

Zilliz

Status
Attu
Vendor
CVE Published:
2 October 2026

What is CVE-2026-105049?

Zilliz Attu, prior to version 3.0.0, contains a significant vulnerability within its Playground feature that allows users to conduct unauthenticated proxying of arbitrary HTTP and HTTPS requests. This flaw exposes the application to potential misuse, enabling attackers to redirect traffic to various URLs on the public internet without proper authentication. It's essential for users of Zilliz Attu to update to the latest version to mitigate the risk associated with this vulnerability.

Affected Version(s)

Attu 2.6.5 < 3.0.0

References

https://bishopfox.com/blog/zilliz-attu-2-6-5
third-party-advisory
https://github.com/zilliztech/attu/issues/1028
issue-tracking

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.