← fix library

HIGH

Milvus vector database exposed to the internet

Why it matters

Your Milvus deployment answers anyone on the internet — its health endpoint fingerprints the exact version, and the gRPC data API (:19530) on the same host has no authentication unless you enabled it. Every embedding you stored can be read, poisoned, modified or deleted. RAG and agent-memory stores often hold document text and long-term agent state (OWASP ASI06). An exposed Attu admin UI confirms the deployment and gives an attacker a console to attach to it.

Fix it — 3 steps

1. Enable authentication: set common.security.authorizationEnabled: true in the Milvus config (or milvus.authenticationEnabled in the Helm values) and restart, then connect with user/password.
2. Take the data API off the internet: bind :19530 and :9091 to the cluster/VPC only, or block them at the firewall — e.g. sudo ufw deny 19530 and sudo ufw deny 9091.
3. If Attu is deployed, put it behind SSO/VPN or take it down — it should never answer the public internet.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:9091/healthz  # should time out or refuse, not return {"status":"ok"}

References

• https://milvus.io/docs/authenticate.md
• https://milvus.io/docs/configure_security.md
• https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/