Weaviate: Authorization Bypass in Static API Key Handler

In Weaviate versions up to 1.37.7 a medium severity vulnerability CVE-2026-11500 was detected. This vulnerability allows a remote attacker to bypass intended access controls and gain unauthorized access. This occurs due to improper validation of the StaticApiKey argument within the validateConfig function of the Static API Key Handler (internal/usecases/auth/authentication/apikey/client.go). Although the attack complexity is high and exploitability is considered difficult, a public exploit is available. To address this issue, users should apply the patch (commit 40f2cc32279f0f8a51016c3c6870a2c0c808e6c0) or upgrade Weaviate to version 1.38.0-rc.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11500.