Qdrant is a specialized vector database designed for similarity search and AI workloads, presenting a narrowly scoped but architecturally critical product in modern machine-learning infrastructure. Vulnerabilities affecting the vendor skew strongly toward critical severity and recur through pathway-control and input-validation weaknesses including path traversal, buffer overflows, and improper file-handling that are characteristic of systems ingesting untrusted query and data inputs at scale. Defenders should treat this vendor's security advisories as high-priority for any deployment serving AI or embeddings pipelines; live severity and exploitation metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Qdrant over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-25628HIGH Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint using an attacker-con | Feb 6, 2026 | 8.8 | 28 | NO | NO |
CVE-2024-3078CRITICAL A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/src/collection/snapsho | Mar 29, 2024 | 9.8 | 27 | NO | NO |
CVE-2024-3829CRITICAL qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapsh | Jun 3, 2024 | 9.1 | 26 | NO | NO |
CVE-2024-2221CRITICAL qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specifically through the `sna | Apr 10, 2024 | 9.8 | 26 | NO | NO |
CVE-2024-3584HIGH qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` | May 30, 2024 | 7.5 | 23 | NO | NO |
CVE-2023-38975HIGH * Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component. | Aug 29, 2023 | 7.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Qdrant.
Media articles that mention a CVE ID that affects a product developed by Qdrant — matched by CVE ID, not by vendor name.