CVE-2026-69111: Milvus unauthenticated DoS

CISO Take

An unauthenticated HTTP GET request to Milvus's management server on port 9091 can shut down the proxy, datanode, or querynode components, because the /management/stop endpoint bypasses the REST API's authentication middleware entirely. For any team running Milvus as the vector store behind a RAG pipeline or semantic search feature, this means an attacker with mere network reach to port 9091 — no credentials, no user interaction, low complexity — can take down retrieval infrastructure at will, degrading or fully halting AI-assisted applications that depend on it. It is not in CISA KEV, has no public exploit or Nuclei template, and EPSS sits at 0.57% (top 56th percentile), so opportunistic mass exploitation is unlikely today, but CISA's SSVC decision is TRACK* and the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) reflects trivial remote reachability. Patch to a fixed Milvus release once available, and in the interim firewall port 9091 to trusted management hosts only (it should never be internet-facing) and alert on unexpected GET requests to /management/stop in access logs.

Sources: NVD EPSS GitHub Advisory ATLAS vulncheck.com

What is the risk?

High exploitability (network-reachable, no auth, no user interaction, low attack complexity) combined with availability-only impact (C:N/I:N/A:H) makes this a straightforward but narrowly-scoped DoS risk. Exposure hinges entirely on whether the Milvus management port (9091) is reachable from untrusted networks — in properly segmented deployments (management interface bound to internal/admin networks only) the practical risk is low; in cloud deployments where operators expose all ports for convenience, it is trivially exploitable by any internet-connected attacker. No exploit code or scanner template is publicly available yet, and EPSS/KEV signals indicate no observed in-the-wild exploitation, so this is a patch-and-harden priority rather than an emergency.

How does the attack unfold?

Discovery

Attacker scans for internet-exposed Milvus deployments by probing the management server's default port 9091.

AML.T0006

Exploitation

Attacker sends an unauthenticated HTTP GET to /management/stop with a role parameter, which bypasses REST API auth middleware entirely.

AML.T0049

Impact

The targeted proxy, datanode, or querynode component shuts down, disrupting query serving and data persistence for every downstream RAG/search application.

AML.T0029

Discovery

Attacker scans for internet-exposed Milvus deployments by probing the management server's default port 9091.

AML.T0006

Exploitation

Attacker sends an unauthenticated HTTP GET to /management/stop with a role parameter, which bypasses REST API auth middleware entirely.

AML.T0049

Impact

The targeted proxy, datanode, or querynode component shuts down, disrupting query serving and data persistence for every downstream RAG/search application.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Milvus	pip	—	No patch
1.4K OpenSSF 5.4 7 dependents Pushed 3d ago 33% patched ~41d to patch Full package profile →

Do you use Milvus? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

1) Upgrade to a patched Milvus release once the vendor ships one (track github.com/milvus-io/milvus/pull/49847 and /pull/51573, which appear to be the fix PRs). 2) Until patched, do not expose port 9091 to untrusted networks — bind the management server to localhost or an internal admin VLAN and enforce this via firewall/security-group rules. 3) Place Milvus behind a network policy or service mesh that restricts inbound access to known operator/orchestration IPs only. 4) Add detection: alert on any GET request to /management/stop or unexpected component restarts in Milvus logs/metrics, and monitor for querynode/datanode/proxy availability drops correlated with unauthenticated management API calls. 5) Review Kubernetes/Helm deployment manifests for Milvus to confirm the management port isn't inadvertently exposed via a public LoadBalancer or NodePort.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS RAG API AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system performance/assurance criteria including resilience

OWASP LLM Top 10

LLM04 - Model Denial of Service

Frequently Asked Questions

What is CVE-2026-69111?

An unauthenticated HTTP GET request to Milvus's management server on port 9091 can shut down the proxy, datanode, or querynode components, because the /management/stop endpoint bypasses the REST API's authentication middleware entirely. For any team running Milvus as the vector store behind a RAG pipeline or semantic search feature, this means an attacker with mere network reach to port 9091 — no credentials, no user interaction, low complexity — can take down retrieval infrastructure at will, degrading or fully halting AI-assisted applications that depend on it. It is not in CISA KEV, has no public exploit or Nuclei template, and EPSS sits at 0.57% (top 56th percentile), so opportunistic mass exploitation is unlikely today, but CISA's SSVC decision is TRACK* and the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) reflects trivial remote reachability. Patch to a fixed Milvus release once available, and in the interim firewall port 9091 to trusted management hosts only (it should never be internet-facing) and alert on unexpected GET requests to /management/stop in access logs.

Is CVE-2026-69111 actively exploited?

No confirmed active exploitation of CVE-2026-69111 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69111?

1) Upgrade to a patched Milvus release once the vendor ships one (track github.com/milvus-io/milvus/pull/49847 and /pull/51573, which appear to be the fix PRs). 2) Until patched, do not expose port 9091 to untrusted networks — bind the management server to localhost or an internal admin VLAN and enforce this via firewall/security-group rules. 3) Place Milvus behind a network policy or service mesh that restricts inbound access to known operator/orchestration IPs only. 4) Add detection: alert on any GET request to /management/stop or unexpected component restarts in Milvus logs/metrics, and monitor for querynode/datanode/proxy availability drops correlated with unauthenticated management API calls. 5) Review Kubernetes/Helm deployment manifests for Milvus to confirm the management port isn't inadvertently exposed via a public LoadBalancer or NodePort.

What systems are affected by CVE-2026-69111?

This vulnerability affects the following AI/ML architecture patterns: vector databases, RAG pipelines, semantic search systems.

What is the CVSS score for CVE-2026-69111?

CVE-2026-69111 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.57%.

What is the AI security impact?

Affected AI Architectures

vector databasesRAG pipelinessemantic search systems

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.

Exploitation Scenario

An attacker scans for internet-facing Milvus deployments (e.g., via Shodan-style port/service fingerprinting on 9091, a known Milvus management port). Finding an exposed instance, they send a single crafted HTTP GET request to /management/stop with a role parameter set to 'proxy' (or 'datanode'/'querynode'), which the endpoint processes without checking authentication because it sits outside the REST API's auth middleware coverage. The targeted component immediately terminates, breaking query serving for every application relying on that Milvus cluster — for example, a customer-facing RAG chatbot suddenly loses its retrieval backend and starts failing or returning degraded, ungrounded responses. The attacker can repeat the request at will, effectively holding the vector database's availability hostage with no credentials and minimal effort.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.