CVE-2026-69111
Received Received - Intake

Unauthenticated DoS in Milvus via Management Server

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulnCheck

Description
Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-06
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-69111
EUVD
EUVD-2026-53581

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
milvus milvus to 2.6.22 (inc)
milvus milvus 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-69111 is an unauthenticated denial of service vulnerability in Milvus versions up to 2.6.22 and 3.0.0. It allows remote attackers to terminate service components like proxy, datanode, or querynode by sending a crafted HTTP GET request to the management server on port 9091. The attack exploits the unprotected /management/stop endpoint, which bypasses REST API authentication middleware.

Detection Guidance

Check if the Milvus management server on port 9091 is exposed to the network. Use commands like 'curl http://<milvus-server>:9091/management/stop' to test for unauthenticated access. Verify if the /management/stop endpoint responds without requiring credentials.

Impact Analysis

This vulnerability can cause complete service outages by allowing attackers to shut down critical Milvus components remotely. It may lead to data unavailability, disrupted operations, and potential data loss if components fail unexpectedly. The attack requires no authentication and can be executed with a single HTTP request.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized denial of service attacks that disrupt data processing and availability. GDPR requires ensuring data availability and integrity, while HIPAA mandates safeguards against unauthorized access or disruptions to critical systems. The lack of authentication on the /management/stop endpoint allows attackers to terminate service components, potentially violating these requirements.

Mitigation Strategies

Enable authentication for management-plane endpoints by setting common.security.adminAuthEnabled=true. Bind the management server to localhost (127.0.0.1) instead of 0.0.0.0 to restrict access. Update Milvus to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69111. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart