Weaviate security release - Medium severity fix for a cross-collection vector disclosure in nearObject (CVE pending assignment)

Weaviate v1.39.3 fixes a medium-severity authorization vulnerability in the GraphQL nearObject search operator that could allow users to reconstruct vectors from objects in collections they were not authorized to read. The flaw occurred because Weaviate checked access to the collection being searched but not to the collection containing the beacon-referenced object whose vector was used for the search; although protected object data was not returned directly, distance values from controlled probe vectors could reveal the target vector with high precision. Exploitation requires knowledge of the target collection and object UUID, permission to view collection definitions, and the ability to create and read probe data in another collection, primarily affecting shared RBAC deployments with collection-level access separation. The update adds authorization checks before beacon target vectors are loaded across all relevant API surfaces, while customers unable to upgrade should restrict read_collections and create_data permissions. Cloud and marketplace customers have already been patched, no exploitation has been observed, and a CVE request is pending following responsible disclosure by Civitasmass.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.