Milvus versions through 2.6.22 and 3.0.0 contain an unauthenticated denial of service vulnerability affecting the management server on port 9091. The unprotected /management/stop endpoint bypasses REST API authentication middleware, allowing remote attackers to send a crafted HTTP GET request with a 'role' parameter to shut down critical service components. Affected components include proxy, datanode, and querynode, whose termination results in denial of service. The vulnerability requires no authentication, making it trivially exploitable by remote attackers. Multiple GitHub issues and pull requests have been filed addressing the flaw, and a VulnCheck advisory has been published. The issue highlights a significant authentication gap in Milvus's management interface design.