Milvus exposes port 9091 by default, and the /expr debug endpoint uses a weak, predictable authentication token derived from etcd.rootPath. This oversight allows anyone with network access to the metrics port to bypass authentication, execute arbitrary expressions, and manipulate both data and credentials through the full REST API. The vulnerability aligns with missing login checks (CWE-306) and results in remote code execution capable of compromising the entire system.

Milvus (milvus-io:milvus) versions prior to 2.5.27 and 2.6.10 are affected. Users running these releases should verify whether their deployments expose port 9091 and whether the /expr endpoint is enabled.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is low but nonzero. The vulnerability is not listed in the CISA KEV catalog. Attacking requires only establishing a TCP connection to the metrics port and sending requests; no authentication is required. The simple attack path and wide exposure make this a high-risk issue for any unathenticated accessible Milvus service.