CVE-2025-15453: Milvus Deserialization RCE Vulnerability

CVE-2025-15453 Overview

A deserialization vulnerability has been identified in Milvus versions up to 2.6.7. This security flaw exists within the expr.Exec function located in the file pkg/util/expr/expr.go of the HTTP Endpoint component. Manipulation of the code argument enables attackers to perform insecure deserialization attacks. The vulnerability is remotely exploitable and has been publicly disclosed.

Critical Impact

Remote attackers with low privileges can exploit this deserialization vulnerability to potentially compromise the confidentiality, integrity, and availability of Milvus deployments through malicious serialized data injection.

Affected Products

• Milvus versions up to and including 2.6.7
• Milvus HTTP Endpoint component (pkg/util/expr/expr.go)

Discovery Timeline

• January 5, 2026 - CVE-2025-15453 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-15453

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the expression execution functionality of Milvus. The expr.Exec function within the HTTP Endpoint component fails to adequately validate and sanitize the code argument before processing, leading to an insecure deserialization condition.

Milvus is a popular open-source vector database designed for AI and machine learning applications. The vulnerable component handles expression parsing and execution for HTTP API requests. When an attacker supplies a specially crafted code parameter to the HTTP endpoint, the application deserializes the input without proper validation, potentially allowing malicious payloads to be executed in the context of the Milvus server.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring physical access to the target system. While the attacker needs low-level privileges to interact with the HTTP endpoint, no user interaction is required for successful exploitation.

Root Cause

The root cause is improper input validation in the expr.Exec function. The function accepts user-controlled input through the code argument and processes it without sufficient sanitization, allowing deserialization of untrusted data. This represents a classic CWE-20 (Improper Input Validation) weakness where external input is not properly validated before being used in security-sensitive operations.

Attack Vector

The attack vector is network-based, targeting the Milvus HTTP Endpoint. An authenticated attacker with low privileges can send specially crafted HTTP requests containing malicious serialized payloads in the code parameter. When the expr.Exec function processes this input, the deserialization of untrusted data can lead to unintended code execution or data manipulation.

The vulnerability has been publicly disclosed through GitHub issues, and proof-of-concept information may be available. Organizations running vulnerable Milvus versions should prioritize remediation. Technical details can be found in the GitHub Issue Discussion.

Detection Methods for CVE-2025-15453

Indicators of Compromise

• Unusual HTTP requests to Milvus endpoints containing serialized data patterns in the code parameter
• Anomalous activity in Milvus logs related to expression parsing errors or unexpected deserialization operations
• Network traffic to Milvus HTTP endpoints with abnormally large or encoded payloads
• Unexpected process spawning or resource consumption by the Milvus service

Detection Strategies

• Deploy web application firewall (WAF) rules to inspect and filter suspicious serialized data patterns in HTTP requests to Milvus endpoints
• Implement network intrusion detection system (IDS) signatures targeting known deserialization attack patterns
• Monitor Milvus application logs for expression execution errors or security-related warnings
• Configure SentinelOne to detect behavioral anomalies associated with deserialization exploits

Monitoring Recommendations

• Enable verbose logging on Milvus HTTP endpoints to capture detailed request information
• Set up alerting for failed authentication attempts and unusual API access patterns
• Monitor system resource utilization for unexpected spikes that may indicate exploitation attempts
• Review network traffic logs for connections to suspicious external destinations from Milvus servers

How to Mitigate CVE-2025-15453

Immediate Actions Required

• Upgrade Milvus to version 2.6.8 or later when available, as a fix is planned for this release
• Restrict network access to Milvus HTTP endpoints using firewall rules and network segmentation
• Implement strong authentication and authorization controls for all Milvus API access
• Review and audit existing Milvus deployments for signs of exploitation

Patch Information

A fix for this vulnerability is scheduled for release in Milvus version 2.6.8. Organizations should monitor the Milvus GitHub Milestone for patch availability. Once released, apply the security update immediately to all affected Milvus instances. Additional vulnerability details are available through VulDB #339486.

Workarounds

• Implement network-level access controls to limit exposure of Milvus HTTP endpoints to trusted networks only
• Deploy a reverse proxy or WAF in front of Milvus to filter and sanitize incoming requests
• Disable or restrict access to expression execution functionality if not required for your deployment
• Consider running Milvus in an isolated network segment with enhanced monitoring until the patch is applied

# Configuration example - Network restriction using iptables
# Restrict Milvus HTTP endpoint access to trusted networks only
iptables -A INPUT -p tcp --dport 19530 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 19530 -j DROP

# Enable verbose logging for Milvus (check your deployment method)
# export MILVUS_LOG_LEVEL=debug