PT-2026-47262 · Weaviate · Weaviate

Dem000 · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-11500

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Weaviate versions prior to 1.38.0-rc.0

Description An issue exists in the Static API Key Handler component within the validateConfig() function of the usecases/auth/authentication/apikey/client.go file. Manipulation of the StaticApiKey argument allows for a remote authorization bypass. The attack complexity is high and exploitability is considered difficult.

Recommendations Upgrade to version 1.38.0-rc.0. As a temporary workaround, restrict access to the validateConfig() function within the Static API Key Handler to minimize the risk of exploitation.

Exploit

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-11500

Affected Products

Weaviate

References · 11

• 🔥 https://github.com/weaviate/weaviate/issues/11392 · Exploit
• https://github.com/weaviate/weaviate/releases/tag/v1.38.0-rc.0 · Patch
• https://github.com/weaviate/weaviate/commit/40f2cc32279f0f8a51016c3c6870a2c0c808e6c0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-11500 · Security Note
• https://vuldb.com/vuln/369120/cti · Note
• https://vuldb.com/cve/CVE-2026-11500 · Note
• https://github.com/weaviate/weaviate · Note
• https://twitter.com/CVEnew/status/2063958175376662948 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2063941788566483120 · Twitter Post
• https://vuldb.com/vuln/369120 · Note
• https://vuldb.com/submit/835080 · Note