CVE-2026-69111 describes a missing authentication vulnerability in milvus-io's Milvus software through versions 2.6.22 and 3.0.0. The vulnerability exists because the /management/stop HTTP GET endpoint on port 9091 does not enforce authentication, allowing remote attackers to supply a 'role' parameter to stop critical components such as proxy, datanode, or querynode. This leads to denial of service by terminating these service components remotely without any authentication.

Successful exploitation results in denial of service by remotely shutting down Milvus service components. This can disrupt availability of the Milvus system, affecting any dependent applications or services. No authentication or user interaction is required, increasing the risk of exploitation. There is no indication of data confidentiality or integrity impact from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the management server port 9091 to trusted networks only and monitor for suspicious requests targeting the /management/stop endpoint. Implement network-level controls to prevent unauthorized access to this management interface.