| Component | Qdrant |
| Severity | medium (CVSS 4.2) |
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
| Published (NVD) | 2026-06-08 |
| Last modified | 2026-07-23 |
| Affected versions | not published yet, see the advisory |
| Fixed in | see the vendor advisory |
| Weakness | CWE-327CWE-328 |
| CISA KEV | not listed |
NVD description
A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file indexer/chunker.go of the component Qdrant Backend. Such manipulation leads to use of weak hash. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep Qdrant off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-11479
- https://github.com/yoanbernabeu/grepai/
- https://github.com/yoanbernabeu/grepai/issues/247
- https://github.com/yoanbernabeu/grepai/pull/248
- https://vuldb.com/cve/CVE-2026-11479
- https://vuldb.com/submit/833971
- https://vuldb.com/vuln/369099
- https://vuldb.com/vuln/369099/cti
Read more
Other Qdrant CVEs
Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files vi...
qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit t...
qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/uploa...
qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload`...
A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the fi...
* Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component.