Vulnerabilities

TI-2026-42273 CVE-2026-59093 · GHSA-667j-56pf-pq9c

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

MEDIUM 41

Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00711 Published 2026-07-02 Fixed in 1.38.0 CWE-266

TI-2025-41468 CVE-2025-67819 · GHSA-hmmh-292h-3364

LOW 23

An issue was discovered in Weaviate OSS before 1.33.4.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00502 Published 2025-12-12 Fixed in 1.30.20, 1.31.19 +2 CWE-22

TI-2025-41467 CVE-2025-67818 · GHSA-7v39-2hx7-7c43

LOW 35

An issue was discovered in Weaviate OSS before 1.33.4.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00905 Published 2025-12-12 Fixed in 1.30.20, 1.31.19 +2 CWE-22

TI-2023-20227 CVE-2023-38976 · GHSA-8697-479h-5mfp

HIGH 72

An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02137 Published 2023-08-21 Fixed in 1.20.6, 1.19.13 +1 CWE-617