Weaviate security release - High severity fix for credential disclosure in the Google modules

Weaviate v1.39.3 fixes a high severity credential disclosure vulnerability in text2vec-google, multi2vec-google and generative-google.

An unvalidated apiEndpoint setting could send the operator's Google credential to an arbitrary host. Collection configuration required schema-write privileges, but the generative-google query path needed only ordinary read access to a collection already using that module.

Weaviate says Cloud customers and Marketplace customers on AWS, Azure and GCP have already been patched. Enterprise Support customers received early notification, and Weaviate is coordinating upgrades with Dedicated customers where appropriate. A CVE is pending assignment. The security release post has the details.