CVE-2026-105049

Received Received - Intake

Unauthenticated HTTP/HTTPS Proxy in Zilliz Attu

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: MITRE

Description

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-02

Generated

2026-10-03

AI Q&A

2026-10-03

EPSS Evaluated

N/A

NVD

CVE-2026-105049

EUVD

EUVD-2026-91837

Affected Vendors & Products

Vendor	Product	Version / Range
zilliz	attu	to 3.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Zilliz Attu before version 3.0.0 contains a Playground feature that allows unauthenticated users to send HTTP and HTTPS requests to any URL on the internet through the application. This could expose internal systems or enable unauthorized interactions with external services.

Detection Guidance

To detect this vulnerability, check if your Zilliz Attu instance (before version 3.0.0) allows unauthenticated HTTP/HTTPS proxy requests. Monitor network traffic for unexpected outbound connections from the Attu service. Inspect proxy logs for requests to external URLs.

Impact Analysis

An attacker could exploit this to send malicious requests from your server, potentially bypassing firewalls or accessing restricted resources. It may also lead to data leaks if sensitive information is transmitted through the proxy.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized data transmission or exposure. Organizations may face penalties for failing to protect sensitive data or maintain secure systems.

Mitigation Strategies

Upgrade Zilliz Attu to version 3.0.0 or later to address the unauthenticated proxying issue in the Playground feature.

Hi! I’m here to help you understand CVE-2026-105049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70