CVE-2026-69111 Details
Description
Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.
A denial-of-service vulnerability has been identified in Milvus versions through 2.6.22 and 3.0.0. The issue arises from an unauthenticated management HTTP server endpoint, '/management/stop', which is accessible on port 9091. This endpoint bypasses REST API authentication and allows remote attackers to terminate critical service components—proxy, datanode, or querynode—by sending a crafted HTTP GET request. The vulnerability is particularly concerning because port 9091 is exposed by default in the official standalone deployment via Docker, creating a significant risk for users.
Users can update to Milvus version 2.6.23 or 3.0.1, where this vulnerability has been addressed. Instructions for updating can be found in the Milvus documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |