Milvus Assess

data-platform security rag vector-database rag-infrastructure lakehouse cve-response self-hosted multi-tenancy secure-defaults open-source

Sep 2026

Overview

Milvus is an open-source, cloud-native vector database built for large-scale similarity search behind generative AI and retrieval workloads. The most consequential product change this cycle is direction rather than scale: Milvus 3.0's External Collection lets the database build and serve ANN indexes over data that remains in Parquet, Iceberg, Lance, or Vortex in an existing lake, instead of requiring a database-owned serving copy kept in sync by an ETL pipeline (Milvus blog). For teams whose embeddings are already produced and versioned in the lake, that is a genuinely different architectural offer from copy-in vector stores.

The security posture, however, has changed materially and in the other direction. CVE-2026-26190 — advisory GHSA-7ppg-37fh-vcr6, published 11 February 2026 — describes two authentication bypasses on TCP port 9091, which Milvus exposes by default: the /expr debug endpoint accepts an auth parameter defaulting to the well-known etcd.rootPath value by-dev, permitting arbitrary internal expression evaluation and disclosure of MinIO secrets, etcd credentials, and user credential hashes; and the full /api/v1/* REST API is registered on the metrics/management port with no authentication at all, covering data manipulation and credential management (advisory, NVD). The CNA scored it 9.8 critical. This follows CVE-2025-64513, a critical proxy bypass via a forged sourceID header that granted full administrative cluster access (GHSA-mhjq-8c7m-3f7p).

Milvus stays in Assess because both facts hold at once: the lake-native direction is worth hands-on evaluation, and the authentication surface has failed more than once with observed exploitation. Patched versions exist and hardening guidance is public, which is why this is not a blanket Hold — but the evidence now shifts the burden of proof onto your deployment hardening, not onto the benchmark.

Adoption Signals

Milvus 3.0 introduces External Collection, indexing and serving lake-resident Parquet, Iceberg, Lance, and Vortex data in place rather than requiring a copied serving dataset (Milvus blog).
Vulnerability handling runs through published GitHub security advisories with named patched versions — 2.4.24, 2.5.21, 2.6.5 for the proxy bypass; 2.5.27 and 2.6.10 for the port 9091 bypass — and a documented gateway workaround for teams that cannot upgrade immediately (GHSA-mhjq-8c7m-3f7p).
Milvus now appears as a default comparator in vector-database security buyer's guides and hardening reviews alongside Pinecone, Weaviate, Qdrant, and Chroma, which is a proxy for evaluation volume in security-reviewed environments (comparison, Particula).
Documented multi-tenancy patterns at database, collection, and partition level, with RBAC confirmed at the first two, give platform teams something concrete to design against (comparison).

Risks

Unauthenticated management surface on 9091. Versions before 2.5.27 and 2.6.10 register the complete REST API on the metrics/management port with no authentication and expose a /expr debug endpoint guarded only by the predictable default token by-dev; reachability of that port is equivalent to full system compromise, including credential management (advisory).
Confirmed exploitation, not theoretical risk. CVE-2026-26190 is reported as observed in sensors between June and August 2026 with EPSS near 37%, though it is not currently in CISA KEV (Previdian).
Insecure defaults survive first install. Milvus 3.0.0 ships authorizationEnabled false with root password Milvus, and the standalone compose publishes the object store on 9000 and 9001 with default credentials; worse, Docker's published ports are diverted in the nat table before a ufw INPUT rule ever evaluates them, so a firewall you believe is closed may not be (Particula).
Exposure becomes a lateral-movement pivot. Research on internet-exposed vector databases found PII, medical records, and plaintext credentials retrievable by semantic search, with the recovered credentials then used to authenticate to unrelated external platforms — the blast radius of one exposed instance is not confined to the embeddings (Orca).
Repeat failures in the same control plane. A critical proxy auth bypass, a critical management-port bypass, and an unauthenticated denial of service through 2.6 have all landed within roughly a year, and a security report filed against 2.6.15 in May 2026 was still open and pushed to a later milestone as of mid-July (SentinelOne, issue #49855).
Client-side and tenancy sharp edges. Unsanitized user input concatenated into vector metadata has produced injection leading to configuration disclosure, and over-privileged full-cluster API keys let a single compromise poison embeddings or delete indices (Kodem). RBAC is not available at the partition level, so partitions are not a tenant security boundary (comparison).

Pros & Cons

Advantages

Milvus 3.0's External Collection feature builds and serves ANN indexes over data that stays in Parquet, Iceberg, Lance, or Vortex, which removes the second serving copy and the sync ETL that traditional vector databases require (Milvus blog).
Critical issues have been handled through published GitHub security advisories with explicit patched versions and, in the proxy case, a gateway-level workaround that strips the sourceID header, so remediation is tractable without replatforming (GHSA-mhjq-8c7m-3f7p).
Milvus documents three tenant isolation strategies for a shared cluster — database, collection, and partition level — with RBAC support at the database and collection levels, giving platform teams a documented basis for multi-tenant design (comparison).

Disadvantages

CVE-2026-26190 registers the full REST API on the metrics/management port 9091 with no authentication, exposing data manipulation and credential management to any attacker who can reach the port; the CNA scored it 9.8 critical and exploitation has been observed in sensors with EPSS around 37% (NVD, Previdian).
Defaults are unsafe out of the box: Milvus 3.0.0 ships authorizationEnabled false with a default root password of Milvus, and the standalone compose file publishes its object store on ports 9000 and 9001 with the default credential pair still in place (Particula).
The authentication surface has failed repeatedly rather than once — a proxy bypass (CVE-2025-64513, scored 9.3) in late 2025, the port 9091 bypass in February 2026, and an unauthenticated denial-of-service through 2.6 — while a security report filed against 2.6.15 in May 2026 remains open against a later milestone (SentinelOne, issue #49855).

Recommendation

Set a hard version floor before any further evaluation work: 2.5.27 or 2.6.10 at minimum for the management-port bypass, and 2.4.24 / 2.5.21 / 2.6.5 for the proxy sourceID bypass (GHSA-7ppg-37fh-vcr6, GHSA-mhjq-8c7m-3f7p). Treat any running instance below those versions as an incident rather than a backlog item, given observed exploitation. If you cannot upgrade this week, strip the sourceID header at the gateway or load balancer as the documented interim mitigation, and block port 9091 at the network layer.

Then fix the defaults explicitly, because none of them are safe on install. Enable authorizationEnabled, rotate the default root password, replace the compose object-store credentials, and verify that 9091, 9000, and 9001 are unreachable from anything but your control plane — testing the actual packet path, not the ufw ruleset, since Docker's published ports bypass it (Particula). Put the database behind a private network, VPN, or authenticating reverse proxy and never on a public interface (Orca). Scope API keys per workload instead of issuing cluster-wide keys, sanitize any user input written into vector metadata, and design tenant boundaries at the database or collection level, not partitions.

Keep Milvus in Assess and scope the spike to what is actually new: run External Collection against a non-sensitive lake dataset and measure whether avoiding the copied serving path pays for the operational surface you are taking on (Milvus blog). Promotion criteria should now include a demonstrated patch-response SLA — how quickly your team can move from advisory publication to patched production — alongside the usual latency and recall numbers. Until you can show that, prefer managed or lower-surface alternatives for workloads holding regulated data.

Sources

May 2026