Summary
Milvus contains an unauthenticated denial-of-service vulnerability in its management server. A remote attacker may send a crafted HTTP GET request to the unprotected /management/stop endpoint and stop selected service components, disrupting availability.
Affected context
The issue affects Milvus deployments where the management server is reachable on port 9091 and its stop endpoint remains accessible without authentication. The endpoint can accept a role parameter identifying components such as the proxy, datanode, or querynode, allowing an external request to terminate those services.
Exploit preconditions
- Attack surface: HTTP management server on port 9091
- Required access: Network connectivity to the management endpoint; no authentication is required
- Trigger point: An HTTP GET request to
/management/stopwith a component role parameter - Why exploitation is possible: The endpoint bypasses REST API authentication middleware and exposes a service-control operation to unauthenticated clients
Why this happens
The vulnerability results from missing authentication on a management endpoint that performs a security-sensitive service-control action. This maps to CWE-306: Missing Authentication for Critical Function, because the application permits remote users to invoke an operationally privileged function without first verifying their identity or authorization.
Potential impact
- Milvus service components may be terminated
- Query, ingestion, or data-processing availability could be disrupted
- Applications depending on affected components may experience outages or errors
- Repeated requests could cause prolonged or recurring denial of service
General mitigation guidance
Mitigation generally focuses on protecting management operations behind authentication and authorization controls.
Common defensive patterns include:
- Require authentication and role-based authorization for every service-control endpoint
- Avoid exposing management interfaces to untrusted or broad network segments
- Apply network policies, firewall rules, or administrative access gateways around port 9091
- Use secure-by-default configurations that disable unnecessary remote management functions
- Separate operational control interfaces from ordinary application traffic
- Rate-limit and monitor sensitive management requests
- Grant service-management privileges only to narrowly scoped administrative identities
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis and route reviews that flag management endpoints lacking authentication middleware
- Code review checks for shutdown, restart, or process-control handlers exposed through HTTP
- Integration tests that verify unauthenticated requests cannot invoke administrative operations
- Network scans and policy audits for publicly reachable management ports
- Runtime monitoring for unexpected requests to stop, restart, or shutdown endpoints
- Automated security review tools that check endpoint authorization coverage
