CVE-2026-59093: Weaviate privilege escalation via unchecked RBAC role assignment

CVE-2026-59093 · Severity: high · CVSS 8.8 · Published 2026-07-02

Weaviate is an open-source vector database used for AI and search applications. A security flaw in its access control system allows users with limited administrative permissions to grant themselves or others full administrative control over the database. This could lead to unauthorized access to sensitive data, data modification, or complete service disruption.

Technologies: Weaviate. Vendors: Weaviate.

Quick answers

Is CVE-2026-59093 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59093 being exploited in the wild.
How severe is CVE-2026-59093?
High severity, with a CVSS score of 8.8, published 2 July 2026.
Which products and versions are affected?
Weaviate before 1.38.0.
Is there a fix for CVE-2026-59093?
A patch was published on 2026-05-28: Fix merged into main branch via pull request 11493 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59093 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-59093?
Check whether you run Weaviate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in Weaviate's RBAC implementation prior to version 1.38.0. The 'assignRoleToUser' and 'assignRoleToGroup' handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) fail to verify that the caller possesses the permissions contained within the role they are assigning. While role creation enforces that a user can only create roles with permissions less than or equal to their own, the assignment handlers only check if the caller has the general 'assign_and_revoke' permission. Consequently, a low-privileged user with assignment rights can assign the built-in 'admin' role to themselves, gaining full control of the database. This issue is resolved in version 1.38.0.

Affected products

  • Weaviate Weaviate before 1.38.0

Timeline

  • 2026-05-28: patched: Fix merged into main branch via pull request 11493
  • 2026-06-05: advisory: Version 1.38.0 released containing the fix
  • 2026-07-02: disclosed: CVE-2026-59093 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.