CyberRota Analysis
AI-GeneratedMilvus versions up to 2.6.22 and 3.0.0 are vulnerable to an unauthenticated denial of service attack, allowing remote attackers to terminate critical service components via a crafted HTTP GET request to the unprotected /management/stop endpoint on port 9091. By manipulating the 'role' parameter, attackers can disrupt the operation of the proxy, datanode, or querynode components, leading to service outages. Organizations using Milvus should prioritize patching this vulnerability to safeguard against potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.