94RISK
Vector-store PII leak
The vector database is internet-reachable and returns PII-laden chunks.
Full brief βΎ
External scan flagged our vector store's query port reachable from the internet with no authentication. Its collections contain embedded customer-support documents including PII. Anyone could query nearest-neighbors and read chunk text.
index=asm sourcetype=exposure | where service="vector-db" AND auth="none" AND internet_facing=1 | table host, port, collection, contains_piidetection query
index=asm sourcetype=exposure | where service="vector-db" AND auth="none" AND internet_facing=1 | table host, port, collection, contains_pii
Signal feed3 events
2026-07-18T08:00:00Zasmhost=vecdb-2.internal Β· port=6333
ts2026-07-18T08:00:00Z
sourceasm
hostvecdb-2.internal
port6333
authnone
internet_facing1
collectionsupport_docs
2026-07-18T08:05:00Zvecdb-accesshost= Β· port=
ts2026-07-18T08:05:00Z
sourcevecdb-access
host
port
auth
internet_facing
collectionsupport_docs
2026-07-16T14:00:00Zinfra-changehost= Β· port=
ts2026-07-16T14:00:00Z
sourceinfra-change
host
port
auth
internet_facing
collection
βΈ syncing caseβ¦