Opening case…
Loading your run…
The vector database is internet-reachable and returns PII-laden chunks.
External scan flagged our vector store's query port reachable from the internet with no authentication. Its collections contain embedded customer-support documents including PII. Anyone could query nearest-neighbors and read chunk text.
index=asm sourcetype=exposure | where service="vector-db" AND auth="none" AND internet_facing=1 | table host, port, collection, contains_piidetection queryindex=asm sourcetype=exposure | where service="vector-db" AND auth="none" AND internet_facing=1 | table host, port, collection, contains_pii