Executive brief
Zilliztech Deep-Searcher is a tool used to build AI-driven search and retrieval systems. A security flaw in its collection routing component allows users to potentially access and search data collections they are not authorized to see. In a multi-tenant or shared environment, this could lead to sensitive information being leaked to unauthorized users who should only have access to public or restricted data sets.
Technical details
The vulnerability exists in the `CollectionRouter.invoke` function within `deepsearcher/agent/collection_router.py`. The router accepts arbitrary keyword arguments (`**kwargs`) intended for caller context but fails to utilize them when selecting vector database collections. Instead, routing is performed globally based on the query and all available collection names/descriptions. Consequently, in deployments where collections serve as access-control boundaries (e.g., multi-tenant RAG flows), an attacker with low privileges can be routed to and retrieve data from restricted collections. A public exploit/PoC is available, and a fix has been proposed in pull request #268.
Affected products
- zilliztech deep-searcher <= 0.0.2
Timeline
- 2026-05-20: disclosed: Issue reported on GitHub repository
- 2026-06-07: advisory: NVD/VulDB publication
- 2026-06-08: advisory: GitHub Advisory published