Skip to main content

Milvus EUVDEUVD-2026-53581

| CVE-2026-69111 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-08-05 VulnCheck GHSA-fvg5-xr32-px64
Denial Of Service Authentication Bypass Milvus
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-accessible management port requires no credentials or user interaction; impact is pure availability from component shutdown with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 05, 2026 - 20:16 vuln.today
Analysis Generated
Aug 05, 2026 - 20:16 vuln.today
CVE Published
Aug 05, 2026 - 19:18 cve.org
HIGH 8.7

DescriptionCVE.org

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.

AnalysisAI

Unauthenticated denial of service in Milvus through 2.6.22 and 3.0.0 allows any remote attacker with network access to port 9091 to immediately terminate core service components - proxy, datanode, or querynode - by issuing a single crafted HTTP GET request. The management server's /management/stop endpoint is not protected by the REST API authentication middleware, making exploitation trivial with a publicly available proof-of-concept. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Milvus management port 9091 exposed
Delivery
Send unauthenticated HTTP GET /management/stop?role=[proxy|datanode|querynode]
Exploit
Request bypasses missing authentication middleware
Execution
Target component receives shutdown signal
Persist
Service component terminates
Impact
Availability disruption until manual restart
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required for default Milvus deployments where port 9091 is network-accessible, because the /management/stop endpoint bypasses authentication middleware entirely when common.security.adminAuthEnabled is false (the default). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) fully corroborates the description: no privileges, no interaction, no special conditions, and high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with network access to port 9091 of a Milvus deployment issues a single HTTP GET request - for example, GET http://target:9091/management/stop?role=proxy - requiring no credentials, session tokens, or prior reconnaissance beyond confirming the port is open. A publicly available PoC (GitHub issue #50763) documents this exact technique, meaning automated scanners or script kiddies can replicate the attack. …
Remediation The upstream fix is introduced in PR #49847 and PR #51573 at https://github.com/milvus-io/milvus/pull/49847 and https://github.com/milvus-io/milvus/pull/51573; a specific released and tagged patch version is not independently confirmed from the available references, so operators should verify whether a released version incorporating these PRs is available before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Milvus deployments and assess which have port 9091 exposed to untrusted networks. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Milvus

View all
CVE-2026-26190 CRITICAL POC
9.8 Feb 13

Unauthenticated API access in Milvus vector database before 2.5.27/2.6.10. TCP port 9091 exposed by default without auth
CVE-2026-10814 LOW POC
1.1 Jun 04

Weak hashing in milvus-io/milvus up to 2.6.13 exposes the Grantee ID Hash Handler in the KV metadata catalog (internal/m

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-53581 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy