-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/milvus-io/milvus | go | >= 0.10.4, < 2.4.24 | 2.4.24 |
| github.com/milvus-io/milvus | go | >= 2.5.0, < 2.5.21 | 2.5.21 |
| github.com/milvus-io/milvus | go | >= 2.6.0, < 2.6.5 | 2.6.5 |
| github.com/milvus-io/milvus | go | < 0.10.3-0.20251107071934-6102f001a971 | 0.10.3-0.20251107071934-6102f001a971 |
Miggo AIRoot Cause AnalysisThe vulnerability is an authentication bypass in the Milvus Proxy. The root cause is that the AuthenticationInterceptor function in internal/proxy/authentication_interceptor.go incorrectly trusted the sourceID header. An unauthenticated attacker could send a request with a specially crafted sourceID header, which would cause the validSourceID function to return true. This would then cause the AuthenticationInterceptor to skip the actual authentication check, granting the attacker administrative access. The patch remediates this by removing the validSourceID function and all logic that checks the sourceID header, thus ensuring that all requests go through the standard authentication process.