CVE-2026-11466: Zilliz deep-searcher Access Control Bypass – CVSS 5.4

Technical summary

CVE-2026-11466 is an improper access control flaw in the CollectionRouter.invoke method within deepsearcher/agent/collection_router.py. The vulnerability stems from insufficient validation of the kwargs parameter, allowing authenticated users to circumvent authorization checks (CWE-266, CWE-284). Remote exploitation requires valid credentials but no additional privileges or user interaction. Zilliz has prepared a fix via pull request, though it remains pending acceptance.

Business impact

Organizations deploying deep-searcher face potential data exposure and service availability risks. Authenticated insiders or compromised user accounts can read sensitive collections or trigger errors that degrade search functionality. In environments where deep-searcher indexes proprietary documents, vector data, or search indices, unauthorized access could expose competitive information or personal data. The moderate CVSS score (5.4) reflects the authentication requirement, but public exploit availability accelerates real-world threat probability.

Affected systems

Zilliz deep-searcher versions up to and including 0.0.2 are vulnerable. No other vendors or products have been identified in the advisory. Organizations should verify their deep-searcher version against release notes and dependency manifests. Early-stage projects and development environments using this library warrant immediate attention given the public exploit status.

Exploitability

Exploitation requires valid authentication credentials and low complexity—an attacker with legitimate user access can craft malicious kwargs to invoke CollectionRouter methods outside their intended scope. The public availability of exploit code removes the barrier to weaponization, meaning this is not a theoretical concern. The absence of CISA KEV listing does not diminish the threat given the combination of public proof-of-concept and modest authentication hurdles in many organizations.

Remediation

Upgrade deep-searcher to a patched version once released and tested. Zilliz's fix is currently under review; monitor their repository and security advisories for an official release. In the interim, apply the following mitigations: restrict deep-searcher API access via network segmentation or authentication gateways, audit access logs for suspicious CollectionRouter invocations, and review user permissions to minimize the number of accounts with search privileges.

Patch guidance

Wait for Zilliz to merge and release the pending fix. Once available, verify the patch version against the official Zilliz releases (GitHub or package registry). Test thoroughly in a staging environment before production rollout, especially if deep-searcher is embedded in critical search or retrieval pipelines. Confirm that the patched version validates kwargs appropriately and enforces collection-level access policies.

Detection guidance

Monitor logs for CollectionRouter.invoke calls that include unexpected or malformed kwargs parameters. Look for patterns where authenticated users access collections outside their stated permissions or query scopes. If deep-searcher exposes metrics or debugging endpoints, alert on unusual method invocations or exception spikes. Network detection should flag unexpected internal API calls to collection-routing services from accounts with minimal search activity.

Why prioritize this

Although CVSS is moderate (5.4), several factors warrant elevated priority: public exploit availability, ease of exploitation for authenticated users, and potential data exposure in environments storing sensitive embeddings or documents. Organizations with strict data governance or that handle regulated information should treat this as high priority. DevOps and platform teams should patch as soon as verified releases are available.

Risk score, explained

CVSS 5.4 (Medium) reflects a network-accessible vulnerability requiring valid authentication and delivering confidentiality and availability impact with no integrity risk. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L indicates low attack complexity and no privilege escalation needed. However, the public exploit availability and the library's role in AI/ML pipelines suggest operational risk may exceed the base score in real-world deployments.

Frequently asked questions