EUVD-2026-53581
GHSA-fvg5-xr32-px64
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible management port requires no credentials or user interaction; impact is pure availability from component shutdown with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.
AnalysisAI
Unauthenticated denial of service in Milvus through 2.6.22 and 3.0.0 allows any remote attacker with network access to port 9091 to immediately terminate core service components - proxy, datanode, or querynode - by issuing a single crafted HTTP GET request. The management server's /management/stop endpoint is not protected by the REST API authentication middleware, making exploitation trivial with a publicly available proof-of-concept. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for default Milvus deployments where port 9091 is network-accessible, because the /management/stop endpoint bypasses authentication middleware entirely when common.security.adminAuthEnabled is false (the default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) fully corroborates the description: no privileges, no interaction, no special conditions, and high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to port 9091 of a Milvus deployment issues a single HTTP GET request - for example, GET http://target:9091/management/stop?role=proxy - requiring no credentials, session tokens, or prior reconnaissance beyond confirming the port is open. A publicly available PoC (GitHub issue #50763) documents this exact technique, meaning automated scanners or script kiddies can replicate the attack. … |
| Remediation | The upstream fix is introduced in PR #49847 and PR #51573 at https://github.com/milvus-io/milvus/pull/49847 and https://github.com/milvus-io/milvus/pull/51573; a specific released and tagged patch version is not independently confirmed from the available references, so operators should verify whether a released version incorporating these PRs is available before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Milvus deployments and assess which have port 9091 exposed to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated API access in Milvus vector database before 2.5.27/2.6.10. TCP port 9091 exposed by default without auth
Weak hashing in milvus-io/milvus up to 2.6.13 exposes the Grantee ID Hash Handler in the KV metadata catalog (internal/m
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today