Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Milvus

Bug bounty on Sorona milvus.io

Accepting reports open-source
Go to program Website
Top reward
$1,500
Top severity paid
Critical
Assets in scope
12
Public CVEs
2
Last change
No changes yet

At a glance

What to know before you start testing.

Pays from $1,500
for critical bugs.
Report on Sorona
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Sorona lists as the payout for each severity.

Severity Reward
Critical $1,500+
High $700+
Medium $300+
Low $100 $100 / 1 month Claude Max
Safe harbor
Partial Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

12 assets you may test, 6 excluded.

Web 1

  • https://milvus.io

Products and areas 11

  • Index build and vector search execution, including the Knowhere engine and the parsing of vectors, index files and search parameters supplied by a caller
  • milvus-lite, the embedded build that runs inside a client process rather than as a server
  • Multi-tenancy through databases, collections and partition keys, wherever isolation is claimed
  • No declared scope exists. The project publishes no SECURITY.md and no policy prose, and the whole of its stated position is that private vulnerability reporting is switched on for milvus-io/milvus. Treat any security defect in the Milvus tree as a fair report
  • Object storage handling for segment data, including the paths and credentials Milvus builds for MinIO or S3
  • Role-based access control: users, roles, privilege grants and the checks meant to keep one tenant's collection out of another tenant's queries
  • The coordinator and node set: root, query, data and index coordinators, the query, data and index nodes, and the RPC between them
  • The metadata store and message queue integrations as Milvus configures and consumes them, covering etcd, Pulsar and Kafka
  • The metrics, health and management ports, including port 9091, and everything reachable on them without a credential
  • The Proxy, which every client request passes through, including its authentication and the routing behind it
  • The RESTful and gRPC APIs in full, covering collection, partition, index, search and administrative operations
Out of scope (6)
  • A deployment whose operator chose never to enable authentication, where the finding is the configuration rather than a defect in Milvus
  • Findings against a long-superseded release with no path to the current one
  • Resource exhaustion from expensive queries against a large index, which is a capacity question
  • Retrieval quality, embedding accuracy and model behaviour, which are not security defects
  • Vulnerabilities in etcd, Pulsar, Kafka or MinIO themselves, unless Milvus's own use of them is what makes the issue reachable
  • Zilliz Cloud and other commercial hosted products, which are outside the open-source repository

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.

While testing

  • Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
  • Report through GitHub private vulnerability reporting on milvus-io/milvus .
  • Keep it out of the public issue tracker.
  • State whether the finding needs credentials and which port carries it.
  • Name the deployment shape: standalone, cluster, the Helm chart, or milvus-lite embedded inside an application.
  • Pin the version you tested and say whether authentication was enabled, since the project ships with it off by default in several deployment paths

Not accepted

  • Resource exhaustion from expensive queries against a large index, which is a capacity question
  • Retrieval quality, embedding accuracy and model behaviour, which are not security defects
  • Findings against a long-superseded release with no path to the current one
  • A deployment whose operator chose never to enable authentication, where the finding is the configuration rather than a defect in Milvus

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2026-10814 Low 1.1 4 Jun 2026
CVE-2026-26190 Critical 9.8 13 Feb 2026

Original policy

Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months 2 Lifetime Auth bypass 40 % Exposed service surface 30 % Access control 18 % Info disclosure 12 % Latest advisories Loading the feed Overview Milvus is the largest open-source vector database in the field and the default self-hosted vector store under a large share of retrieval and agent systems, shipped as a Helm chart, a Compose bundle and an embedded build. It holds the embeddings a company built its search on. CVE-2026-26190 is the reference point: the RESTful API answered unauthenticated callers on the metrics port, which is full system compromise for anyone who exposed 9091. Both advisories this project has ever published are critical, both landed inside the last twelve months, and neither reporter was paid anything. sorona.xyz pays you directly on qualified, reproduced findings. In scope No declared scope exists. The project publishes no SECURITY.md and no policy prose, and the whole of its stated position is that private vulnerability reporting is switched on for milvus-io/milvus . Treat any security defect in the Milvus tree as a fair report The Proxy, which every client request passes through, including its authentication and the routing behind it The RESTful and gRPC APIs in full, covering collection, partition, index, search and administrative operations The metrics, health and management ports, including port 9091, and everything reachable on them without a credential The coordinator and node set: root, query, data and index coordinators, the query, data and index nodes, and the RPC between them Role-based access control: users, roles, privilege grants and the checks meant to keep one tenant's collection out of another tenant's queries Multi-tenancy through databases, collections and partition keys, wherever isolation is claimed The metadata store and message queue integrations as Milvus configures and consumes them, covering etcd, Pulsar and Kafka Object storage handling for segment data, including the paths and credentials Milvus builds for MinIO or S3 Index build and vector search execution, including the Knowhere engine and the parsing of vectors, index files and search parameters supplied by a caller milvus-lite , the embedded build that runs inside a client process rather than as a server Out of scope Zilliz Cloud and other commercial hosted products, which are outside the open-source repository Vulnerabilities in etcd, Pulsar, Kafka or MinIO themselves, unless Milvus's own use of them is what makes the issue reachable A deployment whose operator chose never to enable authentication, where the finding is the configuration rather than a defect in Milvus Resource exhaustion from expensive queries against a large index, which is a capacity question Retrieval quality, embedding accuracy and model behaviour, which are not security defects Findings against a long-superseded release with no path to the current one Most-valued findings Anything reachable without credentials on a service or management port. CVE-2026-26190 put the RESTful API on the metrics port with nothing in front of it, and that shape is the highest-value finding on this target Authentication bypass in the Proxy, the class CVE-2025-64513 landed in. Every client request crosses the Proxy, so a defect there is the whole cluster Missing authorization on internal RPC, where a node or coordinator accepts a call that should have required cluster credentials Cross-tenant reads or writes across a database, collection or partition boundary, on a server that routinely holds several applications' embeddings RBAC defects where a granted role evaluates broader than it was written, particularly around administrative privileges Memory safety and parsing defects in index build or search execution, where a crafted vector, search parameter or index file reaches the C++ engine Credential or path handling into object storage, where Milvus writes and reads segments using the cluster's own storage identity Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on milvus-io/milvus . The repository publishes no SECURITY.md and no security address, so the advisory form is the only private channel that exists Keep it out of the public issue tracker. There is no written policy saying so, because there is no written policy at all, and the advisory thread is the only place an embargo can hold State whether the finding needs credentials and which port carries it. Both published advisories turned on a surface reachable without authentication Name the deployment shape: standalone, cluster, the Helm chart, or milvus-lite embedded inside an application. The exposed surface differs sharply between them Pin the version you tested and say whether authentication was enabled, since the project ships with it off by default in several deployment paths There is no bounty page, no reward language and no platform programme. Nothing here pays for a report Disclosure Coordinated inside the GitHub advisory thread and published as a GHSA with a CVE alongside a fixed release. The maintainers run that pipeline in practice rather than in theory: both of the project's advisories were issued through it, and both carried a critical rating. No policy text sets a response target or an embargo window, so agree the disclosure date in the thread and expect it to track the next patch release. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability