Vector Database Security

Milvus Security Testing: Unauthenticated gRPC API, Collection Data Exfiltration, and Default Credentials

📅 July 3, 2026 ⏱ 13 min read 🏷 Milvus, Vector Database Security, ML Infrastructure Security, AI Security

Milvus is a high-scale vector database purpose-built for ML workloads, used by Alibaba, Tencent, Baidu, and thousands of enterprises for similarity search and recommendation systems. Its security posture on default deployments is permissive: the gRPC API on port 19530 and HTTP REST API on port 9091 require no authentication by default, allowing any network client to list all collections, query stored vectors and their scalar fields, insert or delete records, and drop entire collections; Milvus 2.x introduced an authentication feature with default credentials root/Milvus that must be explicitly enabled — when enabled but not hardened, the default root password gives full administrative access; Milvus Attu, the official web UI deployed alongside Milvus, exposes a full management interface on port 8000 without authentication; the MinIO instance that Milvus uses for segment storage is deployed with default credentials minioadmin/minioadmin in standalone mode; and Milvus cluster mode deploys etcd and Pulsar alongside Milvus, all without authentication, extending the attack surface significantly. This guide covers systematic Milvus security assessment.

Milvus Discovery and Port Scanning
Unauthenticated API Access Testing
Collection Data Exfiltration
Default Credential Testing
MinIO Backend Default Credentials
Milvus Security Hardening

Milvus Discovery and Port Scanning

# Milvus default ports:
# 19530 — gRPC API (primary)
# 9091  — HTTP REST API and metrics
# 8000  — Attu web UI (if deployed)
# 19121 — Milvus proxy (cluster mode)
# 9000  — MinIO S3 API
# 2379  — etcd client port (cluster mode)

# Check Milvus REST health endpoint (no auth required)
curl -s http://milvus.example.com:9091/healthz 2>/dev/null | head -3

# Check Milvus version via REST API
curl -s http://milvus.example.com:9091/api/v1/version 2>/dev/null | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print(f\"Milvus {d.get('version','?')}\")" 2>/dev/null

# Check Attu web UI
curl -s -o /dev/null -w "%{http_code}" \
  http://milvus.example.com:8000 2>/dev/null
# 200 = Attu accessible without authentication

Unauthenticated API Access Testing

# Test Milvus REST API without authentication
# List all collections (no auth on default deployments)
curl -s http://milvus.example.com:9091/api/v1/collections 2>/dev/null | \
  python3 -c "
import json,sys
data = json.load(sys.stdin)
collections = data.get('data', [])
print(f'Collections: {len(collections)}')
for c in collections:
    print(f'  {c}')
" 2>/dev/null

# Get collection statistics (reveals scale of stored data)
COLLECTION="my_vectors"
curl -s "http://milvus.example.com:9091/api/v1/collection/statistics?collection_name=${COLLECTION}" 2>/dev/null | \
  python3 -c "
import json,sys
data = json.load(sys.stdin)
stats = data.get('data', {}).get('stats', [])
for s in stats:
    print(f\"  {s.get('key','?')}: {s.get('value','?')}\")
" 2>/dev/null

Milvus Security Hardening

Milvus Security Hardening Checklist:

Enable Milvus authentication — set common.security.authorizationEnabled=true in milvus.yaml; without this, no credentials are required for any operation
Change the root/Milvus default password immediately after enabling auth — use the Milvus SDK to update the root user password before any other operations
Change MinIO default credentials — update the MinIO access key from minioadmin/minioadmin in the Milvus deployment configuration
Restrict ports 19530 and 9091 to internal networks — never expose Milvus gRPC or REST APIs to the internet without authentication
Secure Attu web UI — place Attu behind authentication (nginx basic auth, OAuth2 proxy) or restrict to internal network access only
Enable TLS for gRPC — configure tls.enable=true and provide certificate paths to encrypt gRPC communication and prevent credential interception
Secure etcd in cluster mode — configure etcd with TLS and client certificate authentication; unauthenticated etcd exposes Milvus metadata and configuration
Create application-specific Milvus users — create dedicated users with collection-level permissions rather than using root for application access

Security Test	Method	Risk
gRPC/REST API unauthenticated collection access	GET /api/v1/collections — lists all collections without credentials	High
Default root/Milvus credentials (when auth enabled)	SDK connect with root/Milvus — full admin access to all collections and users	Critical
Collection vector and scalar data exfiltration	Query API with all fields — exports stored vectors and associated data payloads	High
Attu UI accessible without authentication	Browse http://host:8000 — full management UI for collection browsing and data operations	High
MinIO default credentials (minioadmin/minioadmin)	Access MinIO port 9000 — retrieves all Milvus segment data files from backing store	High
etcd unauthenticated access in cluster mode	etcdctl --endpoints=host:2379 get / --prefix — reads all Milvus metadata and configuration	High

Automate Milvus Security Testing

Ironimo tests Milvus deployments for unauthenticated gRPC and REST API access allowing collection enumeration and data exfiltration, default root/Milvus credentials when authentication is enabled without password rotation, MinIO backing store default credential exposure giving access to all vector segment data files, Attu web UI accessible without authentication, etcd unauthenticated access exposing Milvus cluster metadata, and Milvus APIs communicating without TLS allowing credential interception.

Start free scan

Table of Contents

Milvus Discovery and Port Scanning

Unauthenticated API Access Testing

Milvus Security Hardening

Automate Milvus Security Testing