Log in Start free

Vulnerability · Published Jun 7, 2026 · Assigned by VulDB

CVE-2026-11466zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control

Medium 5.4

In plain English

A medium-severity improper access control in deep-searcher from zilliztech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 83.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collection_router.py. This manipulation of the argument kwargs causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIdeepsearcherno fix listedGHSA-43px-gpwc-q84v
PyPIdeepsearcherno fix listedPYSEC-2026-3567

Affected products (as reported)

VendorProductVersions
zilliztech deep-searcher 0.0.10.0.2

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:P/RL:X/RC:R

References