Vulnerability · Published Aug 5, 2026 · Assigned by VulnCheck

CVE-2026-69111Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop

High 7.5

In plain English

A high-severity missing authentication in milvus from milvus-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.1%top 34.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.

Affected products (as reported)

Vendor	Product	Versions
milvus-io	milvus	0 – through 2.6.223.0.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Researcher Disclosure technical-description, exploit
Pull Request (1) issue-tracking
Pull Request (2) issue-tracking
https://www.vulncheck.com/advisories/milvus-unauthenticated-denial-of-service-via-management-stop third-party-advisory