Executive brief
Weaviate, an open-source vector database used for AI and search applications, contains a vulnerability in how it handles static API keys. If duplicate API keys are configured, the system may incorrectly authenticate a user as a different account, potentially leading to unauthorized data access or modification. Organizations using static API key authentication should upgrade to the recommended version to ensure proper user isolation.
Technical details
An improper authorization vulnerability (CWE-285/CWE-639) exists in Weaviate's Static API Key Handler within the `validateConfig` function of `usecases/auth/authentication/apikey/client.go`. The root cause is the failure to reject or uniquely handle duplicate static API keys in the configuration, which can result in a user authenticating as a different identity than intended. An attacker with low privileges (possession of a valid but potentially duplicated key) could exploit this remotely, though the attack complexity is high as it requires specific configuration conditions. The issue is addressed in version 1.38.0-rc.0 by implementing a check to reject duplicate keys during configuration validation.
Affected products
- Weaviate Weaviate < 1.38.0-rc.0
Timeline
- 2026-06-08: disclosed
- 2026-06-08: advisory
- 2026-07-29: patched