--- title: Zilliz / Attu | 2.6.5 | daily.dev description: Bishop Fox disclosed two vulnerabilities in Zilliz Attu 2.6.5, the GUI admin tool for the Milvus vector database. Missing authentication in the Playground... canonical: https://daily.dev/posts/zilliz-attu-2-6-5-rtc4rhubp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zilliz / Attu | 2.6.5 | daily.dev og:description: Bishop Fox disclosed two vulnerabilities in Zilliz Attu 2.6.5, the GUI admin tool for the Milvus vector database. Missing authentication in the Playground... og:url: https://daily.dev/posts/zilliz-attu-2-6-5-rtc4rhubp og:image: https://api.daily.dev/og/posts/Rtc4RHUBP.png og:image:alt: Zilliz / Attu | 2.6.5 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zilliz / Attu | 2.6.5 **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 19 min read · 0 upvotes · 0 comments ## Summary Bishop Fox disclosed two vulnerabilities in Zilliz Attu 2.6.5, the GUI admin tool for the Milvus vector database. Missing authentication in the Playground feature allowed unauthenticated proxying of arbitrary HTTP/HTTPS requests, while a regex flaw in the isAbsoluteUrl check let attackers bypass private IP restrictions by capitalizing a letter in the URL scheme. Chained together, these flaws enabled SSRF against cloud metadata endpoints, letting researchers steal AWS EC2 IAM credentials, obtain Kubernetes node identity, escalate to a privileged service account, and deploy a reverse-shell pod granting root access within the cluster namespace. Zilliz confirmed the 2.6.x line is unmaintained and will not patch; users must upgrade to Attu 3.0.0, a full frontend/backend rewrite where the issues do not reproduce. Mitigations for those unable to upgrade immediately include network isolation, reverse proxy authentication, restricting the Attu pod's service account permissions, and blocking access to cloud metadata services. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is Attu 2.6.5 vulnerable to SSRF and will Zilliz release a patch? Yes, Attu 2.6.5 has two chained vulnerabilities: missing authentication in the Playground feature and a case-sensitivity flaw in its isAbsoluteUrl regex that allows bypassing private IP restrictions when the URL scheme has an uppercase letter. Zilliz confirmed the 2.6.x release line is no longer maintained and will not receive a fix; users must upgrade to Attu 3.0.0. _Teams running Milvus/Attu in production can track disclosures like this on daily.dev to stay ahead of unpatched SSRF risks._ ### How does the Attu Playground SSRF lead to Kubernetes namespace takeover in EKS? An attacker sends a request with an uppercase URL scheme like HTTP://169.254.169.254 in the url field and a public URL in the host field, bypassing Attu's private IP check and reaching the EC2 instance metadata service. This yields IAM node credentials, which grant kubectl access as system:node, allowing enumeration of pods, creation of a privileged service account token, and deployment of a reverse-shell pod for root access in the namespace. _Platform engineers securing EKS metadata access can use daily.dev to follow real-world SSRF-to-cluster-takeover chains like this one._ ### How can I mitigate SSRF risk in Attu 2.6.5 if I cannot upgrade to 3.0.0 immediately? Restrict network access to the Attu instance by deploying it in an isolated network or placing it behind a reverse proxy requiring authentication. Also limit the permissions of the Kubernetes service account attached to the Attu pod and block pod access to the cloud instance metadata service, since Attu 2.6.x will not receive a security patch. _Anyone hardening self-hosted admin tools against SSRF can find mitigation guidance like this through daily.dev._ ## Similar posts on daily.dev - [Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised](https://daily.dev/posts/mini-shai-hulud-strikes-again-317-npm-packages-compromised-u2ptexbxr) · Hacker News · 2 upvotes · 0 comments - [Shai-Hulud: Here We Go Again. Mass npm Supply Chain Attack Hits the AntV Ecosystem](https://daily.dev/posts/shai-hulud-here-we-go-again-mass-npm-supply-chain-attack-hits-the-antv-ecosystem-nq51smsqn) · StepSecurity · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/zilliz-attu-2-6-5-rtc4rhubp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Zilliz / Attu | 2.6.5","url":"https://daily.dev/posts/zilliz-attu-2-6-5-rtc4rhubp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zilliz-attu-2-6-5-rtc4rhubp"},"datePublished":"2026-09-29T20:37:35.881Z","dateModified":"2026-09-29T20:38:12.108Z","description":"Bishop Fox disclosed two vulnerabilities in Zilliz Attu 2.6.5, the GUI admin tool for the Milvus vector database. Missing authentication in the Playground...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7989f14b947c459ed0f50911629674b7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7989f14b947c459ed0f50911629674b7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/zilliz-attu-2-6-5-rtc4rhubp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,kubernetes","timeRequired":"PT19M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Zilliz / Attu | 2.6.5"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/zilliz-attu-2-6-5-rtc4rhubp#faq","mainEntity":[{"@type":"Question","name":"Is Attu 2.6.5 vulnerable to SSRF and will Zilliz release a patch?","acceptedAnswer":{"@type":"Answer","text":"Yes, Attu 2.6.5 has two chained vulnerabilities: missing authentication in the Playground feature and a case-sensitivity flaw in its isAbsoluteUrl regex that allows bypassing private IP restrictions when the URL scheme has an uppercase letter. Zilliz confirmed the 2.6.x release line is no longer maintained and will not receive a fix; users must upgrade to Attu 3.0.0. Teams running Milvus/Attu in production can track disclosures like this on daily.dev to stay ahead of unpatched SSRF risks."}},{"@type":"Question","name":"How does the Attu Playground SSRF lead to Kubernetes namespace takeover in EKS?","acceptedAnswer":{"@type":"Answer","text":"An attacker sends a request with an uppercase URL scheme like HTTP://169.254.169.254 in the url field and a public URL in the host field, bypassing Attu's private IP check and reaching the EC2 instance metadata service. This yields IAM node credentials, which grant kubectl access as system:node, allowing enumeration of pods, creation of a privileged service account token, and deployment of a reverse-shell pod for root access in the namespace. Platform engineers securing EKS metadata access can use daily.dev to follow real-world SSRF-to-cluster-takeover chains like this one."}},{"@type":"Question","name":"How can I mitigate SSRF risk in Attu 2.6.5 if I cannot upgrade to 3.0.0 immediately?","acceptedAnswer":{"@type":"Answer","text":"Restrict network access to the Attu instance by deploying it in an isolated network or placing it behind a reverse proxy requiring authentication. Also limit the permissions of the Kubernetes service account attached to the Attu pod and block pod access to the cloud instance metadata service, since Attu 2.6.x will not receive a security patch. Anyone hardening self-hosted admin tools against SSRF can find mitigation guidance like this through daily.dev."}}]} ```