HIGH 8.7 NVD
CVE-2026-69111
Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by send
Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.
References
- https://github.com/milvus-io/milvus/issues/50763
- https://github.com/milvus-io/milvus/pull/49847
- https://github.com/milvus-io/milvus/pull/51573
- https://www.vulncheck.com/advisories/milvus-unauthenticated-denial-of-service-via-manageme
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-08-05 via NVD.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.