Milvus EUVD-2026-53581

No special conditions are required for default Milvus deployments where port 9091 is network-accessible, because the /management/stop endpoint bypasses authentication middleware entirely when common.security.adminAuthEnabled is false (the default). The attacker must have TCP connectivity to port 9091, which uses plaintext HTTP - any attacker on the same network segment, or with access through a misconfigured firewall or cloud security group, can exploit this. Exploitation is further constrained to a denial-of-service outcome only: there is no code execution, data exfiltration, or configuration tampering capability via this endpoint. The only limiting factor is network-level access to port 9091; if this port is bound to localhost only or blocked at the network perimeter, exploitation is prevented regardless of software version.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) fully corroborates the description: no privileges, no interaction, no special conditions, and high availability impact. A single unauthenticated HTTP GET terminates a production service component. A publicly available PoC (confirmed by VulnCheck and GitHub issue #50763) further lowers the bar to exploitation. The vulnerability is not yet in CISA KEV, so active mass exploitation has not been confirmed, but the trivial attack surface and public PoC make opportunistic exploitation plausible. A critical nuance: even after applying the fix from PR #49847 or PR #51573, the adminAuthEnabled flag defaults to false - operators must explicitly set it to true, or the authentication bypass persists. This means patched deployments remain vulnerable unless the configuration change is applied alongside the code update. Impact is pure availability (VC:N/VI:N/VA:H); there is no confidentiality or integrity exposure. For AI/ML production environments relying on Milvus for real-time inference pipelines, component termination could cause cascading service outages.

An attacker with network access to port 9091 of a Milvus deployment issues a single HTTP GET request - for example, GET http://target:9091/management/stop?role=proxy - requiring no credentials, session tokens, or prior reconnaissance beyond confirming the port is open. A publicly available PoC (GitHub issue #50763) documents this exact technique, meaning automated scanners or script kiddies can replicate the attack. The targeted component (proxy, datanode, or querynode) terminates immediately, disrupting query processing or data ingestion until the component is manually restarted.