CRITICAL Qdrant: Qdrant vector database open without authentication
Why it matters
Your vector database answers anyone on the internet. Every embedding you stored can be read, modified or deleted, and RAG embeddings usually contain the raw text of your documents. Qdrant ships with no authentication by default, so this is a configuration choice, not a bug.
Fix it — 3 steps
- Enable the API key: set `QDRANT__SERVICE__API_KEY=<long-random-string>` on the container/service and restart. Every client must then send it.
- If nothing off-server needs it, bind it away from the internet instead: publish on 127.0.0.1 (`-p 127.0.0.1:6333:6333`) or block the port: `sudo ufw deny 6333`.
- If you front it with a reverse proxy for TLS, keep the API key on anyway: TLS hides traffic, it does not authenticate callers.
Verify it’s fixed
curl -m 5 http://YOUR_SERVER_IP:6333/collections # should return 401/403 or time out, not a JSON collection list
References
- https://qdrant.tech/documentation/guides/security/
- https://qdrant.tech/documentation/guides/configuration/
Not sure if your stack is exposed?
Run the free check — 30 seconds, safe read-only probes.
Scan your stack