Weaviate security release - High severity fix for credential disclosure in the Google modules
By Steven Van ·
The fix is in v1.39.3; Weaviate Cloud and Marketplace customers are already patched, and a CVE is pending assignment.
Weaviate v1.39.3 fixes a high severity credential disclosure vulnerability in its Google-backed modules. An unvalidated endpoint setting could redirect an outbound request, and the operator's Google credential with it, to an arbitrary host. A CVE has been requested from MITRE and is pending assignment. Weaviate says it will update its post with the CVE ID once issued.
What was affected
The affected modules are text2vec-google, multi2vec-google and generative-google. They let the host for outbound Vertex AI and Gemini requests be set through an apiEndpoint configuration value. That value was written directly into the host portion of the request URL without validation. The operator's configured Google credential was attached to the request as a bearer token regardless of where the request was sent. A user who could influence apiEndpoint could therefore make Weaviate deliver that credential to a host of their choosing.
Two ways to set the value
- Collection configuration: setting moduleConfig.text2vec-google.apiEndpoint (or the equivalent for the other two modules) when creating or updating a collection. Validation at this layer only checked that a project ID was present, and the endpoint string was never checked. This path requires schema-write privileges.
- GraphQL query parameter: generative-google accepted apiEndpoint as an inline parameter on a generative query, and the per-query value overrode the collection default. This path needs only ordinary read access to a collection already configured to use generative-google, with no schema-write privilege and no change to stored configuration.
Weaviate describes the second path as the more serious of the two and the main reason for the severity rating.
Who is patched
Under Weaviate's security policy, customers on Weaviate Cloud and Marketplace customers on AWS, Azure and GCP have already been patched. Enterprise Support customers received early notification under embargo. Weaviate's customer-facing teams are working with Weaviate Dedicated customers to organize version upgrades where appropriate.