CVE-2026-69111 Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop
Remote attackers can cause denial of service by sending unauthenticated requests to the management stop endpoint, requiring an upgrade to secure the service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-69111?
CVE-2026-69111 is a high-severity missing authorization vulnerability in milvus-io milvus, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.
Weakness: CWE-306
Which versions are affected by CVE-2026-69111?
1 open source package ship an affected version, including milvus.
| Package | Affected | Fixed in |
|---|---|---|
milvus Bitnami | All versions | 3.0.1 |
How do I fix CVE-2026-69111?
Upgrade milvus to 3.0.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-69111 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69111 exists.
Sources
Also known as BIT-milvus-2026-69111, GHSA-fvg5-xr32-px64.