CVE-2026-69111

HighCVSS 7.5

Published: 05/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.10%

65th percentile - higher than 65% of all known CVEs

Summary

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability allowing remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down proxy, datanode, or querynode components.

Risk Assessment

An attacker can cause service disruption in Milvus, leading to system unavailability and potential data loss. Lack of authentication facilitates remote exploitation.

Recommendation

Upgrade Milvus to a patched version or secure the /management/stop endpoint against unauthorized access. Restrict access to port 9091.

Other vulnerabilities in Milvus

CVE-2025-15453Medium
A security vulnerability was detected in milvus up to 2.6.7, affecting the function expr.Exec in the file pkg/util/expr/expr.go of the HTTP Endpoint component. Manipulation of the code argument leads to deserialization, and remote exploitation is possible.

Original NVD description (English source)

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS