milvus-io vulnerabilities and threats

Milvus versions up to 2.6.22 and version 3.0.0 contain an unauthenticated denial of service vulnerability. Remote attackers can send crafted HTTP GET requests to the management server on port 9091 to exploit an unprotected /management/stop endpoint. This endpoint bypasses REST API authentication middleware and allows attackers to shut down key service components, causing denial of service.

A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3d932f1c3e065351c4440c27abe1e6479752544d. Applying a patch is the recommended action to fix this issue.

Milvus versions prior to 2.5.27 and 2.6.10 have a critical authentication bypass vulnerability. The default TCP port 9091 exposes a debug endpoint (/expr) that uses a weak, predictable authentication token, allowing arbitrary expression evaluation. Additionally, the full REST API is accessible on the metrics/management port without authentication, enabling unauthenticated access to all business operations including data and credential management. This vulnerability is fixed in versions 2.5.27 and 2.6.10.

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the Milvus cluster. This grants the attacker the ability to read, modify, or delete data, and to perform privileged administrative operations such as database or collection management. This issue has been fixed in Milvus 2.4.24, 2.5.21, and 2.6.5. If immediate upgrade is not possible, a temporary mitigation can be applied by removing the sourceID header from all incoming requests at the gateway, API gateway, or load balancer level before they reach the Milvus Proxy. This prevents attackers from exploiting the authentication bypass behavior.