CVE-2025-64513: Milvus Auth Bypass Vulnerability

CVE-2025-64513 Overview

CVE-2025-64513 is a critical authentication bypass vulnerability in Milvus, an open-source vector database designed for generative AI applications. An unauthenticated attacker can exploit this flaw in the Milvus Proxy component to completely bypass all authentication mechanisms, gaining full administrative access to the Milvus cluster. This vulnerability allows attackers to read, modify, or delete data, as well as perform privileged administrative operations such as database or collection management.

Critical Impact
Unauthenticated attackers can gain full administrative access to Milvus clusters, enabling complete data compromise and administrative control without any credentials.

Affected Products

Milvus versions prior to 2.4.24
Milvus versions prior to 2.5.21
Milvus versions prior to 2.6.5

Discovery Timeline

2025-11-10 - CVE-2025-64513 published to NVD
2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-64513

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287: Improper Authentication) exists in the Milvus Proxy component, which serves as the entry point for client connections to the Milvus cluster. The vulnerability allows unauthenticated attackers to completely circumvent authentication mechanisms by exploiting improper handling of the sourceID header in incoming requests. When this header is manipulated or crafted in a specific way, the Proxy component fails to properly validate the request's authentication status, treating the connection as if it were already authenticated with administrative privileges.

The impact of successful exploitation is severe. Attackers gain the ability to perform any operation within the Milvus cluster, including reading sensitive vector embeddings and metadata, modifying or corrupting stored data, deleting databases and collections, and executing privileged administrative commands. For organizations using Milvus as part of their AI/ML infrastructure, this could lead to data breaches, model poisoning, or complete loss of vector data assets.

Root Cause

The root cause of this vulnerability lies in improper authentication validation within the Milvus Proxy component. The system incorrectly trusts the sourceID header value in incoming requests without adequately verifying the authentication state of the connection. This design flaw allows attackers to craft requests that the Proxy interprets as originating from an authenticated administrative context, bypassing the intended security controls entirely.

Attack Vector

The vulnerability is exploitable over the network without any authentication requirements or user interaction. An attacker with network access to the Milvus Proxy can craft malicious requests containing a specially formed sourceID header. When the Proxy receives these requests, it fails to enforce authentication checks, granting the attacker full administrative access to the cluster.

The attack does not require any prior credentials, existing sessions, or user interaction. Any network-accessible Milvus deployment running a vulnerable version is at risk. This is particularly concerning for cloud deployments or instances exposed to the internet, where external attackers could discover and exploit vulnerable systems.

For technical details on the vulnerability mechanics and the specific fixes implemented, refer to the GitHub Security Advisory GHSA-mhjq-8c7m-3f7p.

Detection Methods for CVE-2025-64513

Indicators of Compromise

Unexpected administrative operations in Milvus logs from unrecognized sources or IP addresses
Anomalous database or collection creation, modification, or deletion events
Requests containing suspicious or malformed sourceID headers in access logs
Unusual data access patterns or bulk data retrieval operations
Authentication bypass indicators where operations succeed without valid credentials

Detection Strategies

Monitor Milvus Proxy access logs for requests containing unexpected sourceID header values
Implement network-level monitoring to detect unusual traffic patterns targeting Milvus ports
Deploy intrusion detection rules to identify authentication bypass attempts in request headers
Audit administrative operations and compare against authorized user activity

Monitoring Recommendations

Enable verbose logging on the Milvus Proxy component to capture all incoming request headers
Configure alerts for any administrative operations performed from unexpected network sources
Implement real-time monitoring of database and collection management operations
Establish baseline traffic patterns and alert on significant deviations

How to Mitigate CVE-2025-64513

Immediate Actions Required

Upgrade Milvus to version 2.4.24, 2.5.21, or 2.6.5 or later immediately
If immediate upgrade is not possible, implement the sourceID header stripping workaround at the network edge
Audit Milvus access logs for any suspicious activity that may indicate prior exploitation
Review and restrict network access to Milvus Proxy to only trusted sources

Patch Information

The Milvus maintainers have addressed this vulnerability in versions 2.4.24, 2.5.21, and 2.6.5. Organizations should upgrade to the appropriate patched version based on their current deployment. The fixes are documented in the following pull requests:

Workarounds

Strip the sourceID header from all incoming requests at the gateway, API gateway, or load balancer level before they reach the Milvus Proxy
Implement network segmentation to restrict access to Milvus Proxy from untrusted networks
Deploy a Web Application Firewall (WAF) configured to filter requests with suspicious header patterns
Use network access controls to limit Milvus Proxy exposure to only authorized client IP ranges

bash

# Example nginx configuration to strip sourceID header
# Add to your nginx server block handling Milvus traffic
location / {
    proxy_set_header sourceID "";
    proxy_pass http://milvus-proxy:19530;
}