{"data":{"id":"1b695d34-ba05-4704-9982-6c50a98179b1","title":"CVE-2025-64513: Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit…","summary":"Milvus versions prior to 2.4.24, 2.5.21, and 2.6.5 contain a flaw that lets an unauthenticated attacker bypass all authentication in the Milvus Proxy component. A successful attacker gains full administrative access to the Milvus cluster, with the ability to read, modify, or delete data and perform privileged operations such as database or collection management.","solution":"Fixed in Milvus 2.4.24, 2.5.21, and 2.6.5. If immediate upgrade is not possible, remove the sourceID header from all incoming requests at the gateway, API gateway, or load balancer level before they reach the Milvus Proxy.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-64513","publishedAt":"2025-11-11T03:15:40.270Z","cveId":"CVE-2025-64513","cweIds":["CWE-287"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/milvus-io/milvus@>= 0.10.4, < 2.4.24 (fixed: 2.4.24)","github.com/milvus-io/milvus@>= 2.5.0, < 2.5.21 (fixed: 2.5.21)","github.com/milvus-io/milvus@>= 2.6.0, < 2.6.5 (fixed: 2.6.5)","github.com/milvus-io/milvus@< 0.10.3-0.20251107071934-6102f001a971 (fixed: 0.10.3-0.20251107071934-6102f001a971)"],"affectedPackageNames":["github.com/milvus-io/milvus"],"affectedPackageRefs":["go:github.com/milvus-io/milvus"],"affectedVendors":[],"affectedVendorsRaw":["Milvus"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Milvus authentication bypass in Proxy component grants administrative access","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00869,"epssCheckedAt":"2026-11-04T18:09:14.608Z","kevDateAdded":null,"advisoryAliases":["GHSA-mhjq-8c7m-3f7p"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:04.950Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-11-07T07:19:34.000Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:43:15.065Z","capecIds":["CAPEC-114"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/milvus-io/milvus","fixedVersion":"2.4.24","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:43:14.911Z"},{"ecosystem":"go","name":"github.com/milvus-io/milvus","fixedVersion":"2.6.5","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:43:14.911Z"},{"ecosystem":"go","name":"github.com/milvus-io/milvus","fixedVersion":"0.10.3-0.20251107071934-6102f001a971","matchedVersion":"v0.10.3-0.20251107071934-6102f001a971","fixReleasedAt":"2025-11-07T07:19:34.000Z","daysToFix":-4,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:43:14.911Z"},{"ecosystem":"go","name":"github.com/milvus-io/milvus","fixedVersion":"2.5.21","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:43:14.911Z"}]}}