AI Data at Risk: Critical Milvus Flaw (CVSS 9.8) Exposes Database via Port 9091

A critical vulnerability (CVSS 9.8) was found in Milvus versions < 2.5.27 and >= 2.6.0, < 2.6.10 that exposed TCP port 9091 by default, allowing unauthenticated access to a debug expression endpoint and the full REST API; attackers who reach the port can steal secrets, delete or corrupt data, create admin accounts, and potentially achieve remote code execution. Maintainers released patches (upgrade to 2.5.27 or 2.6.10) and advise blocking external access to port 9091 if immediate patching is not possible.