Milvus-io vulnerabilities
We track 4 vulnerabilities in Milvus-io products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
Latest Milvus-io vulnerabilities
- 7.5 High severity
milvus: Missing Authentication for Critical Functionality
Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unpr
- 7.0 High severity
milvus: Use of a Broken or Risky Cryptographic Algorithm
A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack
- 9.8 Critical severity
milvus: Missing Authentication for Critical Functionality
Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication
- 9.3 Critical severity
milvus: Improper Authentication
Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining