TechPrufer
Get started
Weaviate
Weaviate logoWeaviate · Feature trail

Enterprise Authentication and Authorization

3 posts · Feb 2026 – Oct 2026

What this trail covers

Weaviate supports enterprise security needs through robust authentication and authorization mechanisms. This includes API key management for programmatic access, OpenID Connect (OIDC) integration with external Identity Providers (IdPs) for centralized user management and SSO, and Role-Based Access Control (RBAC) for fine-grained permission management. RBAC allows for the definition of custom roles and permissions, and can be integrated with OIDC groups for dynamic role assignment. Audit logging is also available. This post details a specific medium severity authorization vulnerability in the GraphQL `nearObject` search operator where a user could read the vector of an object in a collection they do not have permission to read, by reconstructing the protected vector through probe objects. The fix authorizes the beacon target before its vector is loaded, at the shared vector lookup.

All Weaviate trails
  1. Weaviate security release - Medium severity fix for a cross-collection vector disclosure in nearObject (CVE pending assignment) | WeaviateDetails a medium severity authorization vulnerability in the GraphQL `nearObject` search operator where a user could reconstruct the vector of an object in a collection they do not have permission to read. The attack vector involves using probe objects in a controlled collection to infer the protected vector's distance from objects in an unauthorized collection. The fix involves authorizing the beacon target before its vector is loaded at the shared vector lookup, ensuring consistent authorization checks across API surfaces.
  2. Securing Enterprise AI with Weaviate | WeaviateThis post extends the 'Enterprise Authentication and Authorization' feature thread by detailing how to scale OIDC integration and RBAC for enterprise environments. It introduces the concept of using OIDC groups to automatically manage Weaviate roles, reducing manual provisioning and ensuring access stays in sync with organizational changes. It also elaborates on multi-tenant security within Weaviate, demonstrating how RBAC can be used to enforce strict data isolation between different tenants (e.g., hospitals) within a shared collection, without requiring separate Weaviate clusters. The post provides code examples for assigning roles to OIDC groups and for creating tenant-scoped RBAC permissions.
  3. Weaviate Authentication & Authorization: A Complete Security Guide | WeaviateThis post details Weaviate's authentication and authorization features, focusing on API keys, OIDC integration, and RBAC. It introduces programmatic user management for API keys (v1.30+) allowing runtime creation, deletion, and rotation. It elaborates on OIDC integration for SSO and MFA, highlighting the use of OIDC groups for RBAC. The post also emphasizes the importance of audit logging for security monitoring, incident response, and compliance. It provides practical examples and use cases for each feature.