CVE-2026-69111: Milvus unauthenticated denial of service via /management/stop endpoint

Summary

CVE-2026-69111 affects Milvus through 2.6.22 and 3.0.0. An unauthenticated remote attacker can send a crafted HTTP GET request to the management server on port 9091, reaching the unprotected /management/stop endpoint, which bypasses REST API authentication middleware. By supplying a 'role' parameter, the attacker can shut down the proxy, datanode, or querynode components, causing denial of service. The weakness is classified as CWE-306, and VulnCheck rates it CVSS 4.0 8.7 (HIGH), while NVD has not yet provided an assessment.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
• HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
• HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database
• HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
• MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database