Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/milvus-io/milvus
  4. ›
  5. CVE-2025-64513

CVE-2025-64513: Milvus Proxy has a Critical Authentication Bypass Vulnerability

November 13, 2025

What kind of vulnerability is it? Who is impacted? An unauthenticated attacker can exploit this vulnerability to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the Milvus cluster. This grants the attacker the ability to read, modify, or delete data, and to perform privileged administrative operations such as database or collection management. All users running affected Milvus versions are strongly advised to upgrade immediately.

References

  • github.com/advisories/GHSA-mhjq-8c7m-3f7p
  • github.com/milvus-io/milvus
  • github.com/milvus-io/milvus/commit/6102f001a971c8c8055a4a4cae704442d5cab793
  • github.com/milvus-io/milvus/pull/45379
  • github.com/milvus-io/milvus/pull/45383
  • github.com/milvus-io/milvus/pull/45391
  • github.com/milvus-io/milvus/security/advisories/GHSA-mhjq-8c7m-3f7p
  • nvd.nist.gov/vuln/detail/CVE-2025-64513

Code Behaviors & Features

Detect and mitigate CVE-2025-64513 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.10.4 before 2.4.24, all versions starting from 2.5.0 before 2.5.21, all versions starting from 2.6.0 before 2.6.5

Fixed versions

  • 2.4.24
  • 2.5.21
  • 2.6.5

Solution

Upgrade to versions 2.4.24, 2.5.21, 2.6.5 or above.

Impact 9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-287: Improper Authentication

Source file

go/github.com/milvus-io/milvus/CVE-2025-64513.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Mon, 24 Nov 2025 00:19:46 +0000.