CVE-2026-69111

Name of the Vulnerable Software and Affected Versions Milvus versions 2.6.22 through 3.0.0

Description An unauthenticated denial of service issue exists that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. The issue stems from the /management/stop endpoint, which bypasses REST API authentication middleware. By providing a specific role parameter, an attacker can shut down the proxy, datanode, or querynode components.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.