# CVE-2026-11500: Weaviate authorization bypass via duplicate Static API Keys

Source: https://junglewise.ai/threats/cve-2026-11500-weaviate-authorization-bypass-via-duplicate-static-api-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-11500 · Severity: medium · CVSS 5 · Published 2026-06-08

Weaviate, an open-source vector database used for AI and search applications, contains a vulnerability in how it handles static API keys. If duplicate API keys are configured, the system may incorrectly authenticate a user as a different account, potentially leading to unauthorized data access or modification. Organizations using static API key authentication should upgrade to the recommended version to ensure proper user isolation.

Technologies: [github.com/weaviate/weaviate (Go)](https://junglewise.ai/threats/technologies/github-com-weaviate-weaviate), [Weaviate](https://junglewise.ai/threats/technologies/weaviate). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Weaviate](https://junglewise.ai/threats/vendors/weaviate).

## Quick answers

**Is CVE-2026-11500 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11500 being exploited in the wild.

**How severe is CVE-2026-11500?** Medium severity, with a CVSS score of 5, published 8 June 2026.

**Which products and versions are affected?** github.com/weaviate/weaviate (Go) < 1.38.0-rc.0, SEMVER:introduced=0,fixed=1.38.0-rc.0; Weaviate < 1.38.0-rc.0, up to 1.37.7.

**Is there a fix for CVE-2026-11500?** Yes. github.com/weaviate/weaviate (Go): upgrade to 1.38.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11500 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11500?** Check whether you run github.com/weaviate/weaviate (Go) or Weaviate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/weaviate/weaviate (Go): upgrade to 1.38.0-rc.0 or later

  ```sh
  go get github.com/weaviate/weaviate@v1.38.0-rc.0
  ```


## Technical details

An improper authorization vulnerability (CWE-285/CWE-639) exists in Weaviate's Static API Key Handler within the `validateConfig` function of `usecases/auth/authentication/apikey/client.go`. The root cause is the failure to reject or uniquely handle duplicate static API keys in the configuration, which can result in a user authenticating as a different identity than intended. An attacker with low privileges (possession of a valid but potentially duplicated key) could exploit this remotely, though the attack complexity is high as it requires specific configuration conditions. The issue is addressed in version 1.38.0-rc.0 by implementing a check to reject duplicate keys during configuration validation.

## Affected products

- Weaviate Weaviate < 1.38.0-rc.0

## Identifiers

- CVE-2026-11500
- GHSA-jqpm-wf57-qx5c
- GO-2026-6140

## Timeline

- 2026-06-08: disclosed
- 2026-06-08: advisory
- 2026-07-29: patched

## References

- [https://github.com/weaviate/weaviate/issues/11392](https://github.com/weaviate/weaviate/issues/11392)
- [https://github.com/weaviate/weaviate/commit/40f2cc32279f0f8a51016c3c6870a2c0c808e6c0](https://github.com/weaviate/weaviate/commit/40f2cc32279f0f8a51016c3c6870a2c0c808e6c0)
- [https://github.com/weaviate/weaviate](https://github.com/weaviate/weaviate)
- [https://github.com/weaviate/weaviate/releases/tag/v1.38.0-rc.0](https://github.com/weaviate/weaviate/releases/tag/v1.38.0-rc.0)
- [https://vuldb.com/cve/CVE-2026-11500](https://vuldb.com/cve/CVE-2026-11500)

## Related threats

- [Weaviate privilege escalation via unchecked RBAC role assignment](https://junglewise.ai/threats/cve-2026-59093-weaviate-privilege-escalation-via-unchecked-rbac-role-assignment)
- [GO-2025-4238 - Weaviate OSS has path traversal vulnerability via the Shard Movement API in github.com/weaviate/weaviate](https://junglewise.ai/threats/cve-2025-67819-weaviate-oss-has-path-traversal-vulnerability-via-the-shard)
- [GO-2025-4237 - Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip in github.com/weaviate/weaviate](https://junglewise.ai/threats/cve-2025-67818-weaviate-oss-has-a-path-traversal-vulnerability-via-backup)
- [GO-2023-2017 - Denial of service vulnerability in github.com/weaviate/weaviate](https://junglewise.ai/threats/cve-2023-38976-weaviate-denial-of-service-vulnerability)
- [Duplicate Advisory: weaviate denial of service vulnerability](https://junglewise.ai/threats/duplicate-advisory-weaviate-denial-of-service-vulnerability-c67b3926)