Read the docs
TI-2026-09929 Aliases CVE-2026-11500GHSA-jqpm-wf57-qx5c

Weaviate Static API Key client.go validateConfig authorization

Priority MEDIUM 45CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

A vulnerability was identified in Weaviate up to 1.37.7. This vulnerability affects the function validateConfig of the file usecases/auth/authentication/apikey/client.go of the component Static API Key Handler. The manipulation of the argument StaticApiKey leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. Upgrading to version 1.38.0-rc.0 is able to resolve this issue. The identifier of the patch is 40f2cc32279f0f8a51016c3c6870a2c0c808e6c0. You should upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Weaviate: 1.38.0-rc.0github.com/weaviate/weaviate (Go): 1.38.0-rc.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Weaviate1.37.0; 1.37.1; 1.37.2; 1.37.3; 1.37.4; 1.37.5; 1.37.6; 1.37.71.38.0-rc.0Patch availableCNA
—github.com/weaviate/weaviate (Go)before 1.38.0-rc.01.38.0-rc.0Patch availableGHSA-jqpm-wf57-qx5c
  • Weaviate Vendor— Affected 1.37.0; 1.37.1; 1.37.2; 1.37.3; 1.37.4; 1.37.5; 1.37.6; 1.37.7 Fixed in 1.38.0-rc.0 Patch available CNA
  • github.com/weaviate/weaviate (Go) Vendor— Affected before 1.38.0-rc.0 Fixed in 1.38.0-rc.0 Patch available GHSA-jqpm-wf57-qx5c

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:*——Weaviate
  • cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:* Versions — — ·Weaviate

Remediation

  • Fix · CNA Weaviate Fixed in 1.38.0-rc.0
  • Fix · GHSA-jqpm-wf57-qx5c github.com/weaviate/weaviate (Go) Fixed in 1.38.0-rc.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11500
  2. 2026-10-03 Alias added: GHSA-jqpm-wf57-qx5c

References

Exploit 1

Patch 2

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences