A weakness in the Grantee ID Hash Handler in Milvus up to version 2.6.13 allows the use of a weak hash algorithm. This can enable a local attacker to create hash collisions that may compromise the uniqueness of grant identifiers, potentially allowing unauthorized operations or data manipulation. The vulnerability is infrequently exploitable, requiring high complexity efforts and local execution.

Milvus 2.6.13 and earlier versions of the Milvus open‑source vector database are affected. The flaw resides in the internal/metastore/kv/rootcoord/kv_catalog.go component of the Milvus product released by Milvus‑IO.

The CVSS score of 2 indicates a low impact; the EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog. The attack requires local system access, high complexity, and is considered difficult to exploit. Consequently, the risk is limited to environments where local privileges can be obtained, and the likely attack vector is an insider or compromised host.