EXPOSURE Milvus
SEVERITY HIGH
PROBE GET :9091/healthz
Is your Milvus exposed?
Health endpoint answers with version. The vector API (and usually the Attu admin UI) behind it needs no login either.
Scan a host you own → Fix card Census
Why it matters
Your Milvus deployment answers anyone on the internet — its health endpoint fingerprints the exact version, and the gRPC data API (:19530) on the same host has no authentication unless you enabled it. Every embedding you stored can be read, poisoned, modified or deleted. RAG and agent-memory stores often hold document text and long-term agent state (OWASP ASI06). An exposed Attu admin UI confirms the deployment and gives an attacker a console to attach to it.
How common is it?
536 Milvus instances are reachable in the Shodan index. Fingerprint match, not a verified zero-auth count · src: Shodan count · `product:"Milvus"` · 2026-08
Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.
Fix it
The full walkthrough lives on the fix card, kept current in one place: