CVE-2025-15453 Details

A remote expression execution vulnerability has been identified in Milvus versions through 2.6.7. The issue arises in the HTTP endpoint '/expr', specifically within the 'pkg/util/expr/expr.go' file. The vulnerability allows for deserialization of user-provided expressions, which can be exploited remotely. When the endpoint is accessible and its authentication secret is weak or known, an attacker could execute arbitrary expression logic. This exploitation could lead to unauthorized access to internal configuration or state, manipulation of runtime settings, or denial-of-service conditions by causing excessive resource consumption.

Users are advised to disable the '/expr' endpoint by default or remove it in production builds. The internal HTTP server should be configured to only accept requests from localhost or be protected by firewall rules. Additionally, the authentication mechanism should be strengthened by using a high-entropy token instead of the default etcd.rootPath value. After applying these changes, the endpoint should be tested to ensure that the vulnerability has been effectively mitigated.