Zilliz Attu 2.6.5 (Bishop Fox 29 Sep): unauth Playground proxy + private-IP bypass → EKS/K8s namespace takeover; fix Attu 3.0.0 (2.6.x unmaintained)
Bishop Fox advisory (29 September 2026) details two vulnerabilities in Zilliz Attu 2.6.5 — the GUI admin tool for the Milvus vector database used in AI/ML stacks. Missing authentication (Bishop Fox: Critical) in the Playground feature lets unauthenticated attackers proxy arbitrary HTTP/HTTPS requests through an exposed Attu instance. Insecure input validation (Bishop Fox: High) bypasses private-IP blocking (DNS resolve vs host-header split), enabling requests to internal addresses and cloud metadata endpoints. Combined in a typical Milvus+Attu Amazon EKS deployment, Bishop Fox demonstrated administrative access to the Kubernetes namespace hosting Attu (and possible wider cloud impact depending on service-account permissions). No CVE identifiers assigned in the advisory. Vendor: Attu 2.6.x is no longer maintained and will not receive a 2.6.5 patch; upgrade to Attu 3.0.0 (released 3 Sep 2026; substantial rewrite). Bishop Fox could not reproduce either issue on 3.0.0. If upgrade is delayed: restrict network access, put Attu behind an authenticating reverse proxy, and tightly scope the Attu pod’s Kubernetes service-account permissions. Desk does not reproduce the chain. Primary: Bishop Fox 29 Sep; vendor path: Attu 3.0.0 release.
- Product
- Zilliz Attu (Milvus admin GUI) 2.6.5
- Versions
- Affected: Attu 2.6.5 (2.6.x line unmaintained per vendor). Fixed / not reproducible: Attu 3.0.0 (released 3 Sep 2026). No 2.6.5 patch planned.
- Exploited in Australia?
- unknown
- Patch to
- Upgrade Attu to 3.0.0 immediately; do not expect a 2.6.5 backport. Until upgraded: do not expose Attu to untrusted networks; require auth at a reverse proxy; minimise Kubernetes service-account rights on the Attu pod; block pod egress to cloud metadata and sensitive internal APIs where practical. Re-validate after upgrade — Bishop Fox verified 3.0.0 does not reproduce the Playground auth bypass or private-IP validation issues.
Primary: Bishop Fox — Zilliz / Attu | 2.6.5 (advisory, 29 Sep 2026) · Vendor: Zilliz Attu v3.0.0 release (vendor upgrade path; 2.6.x unmaintained) · Zilliz — Attu product hub (Milvus GUI)