TechPrufer
Get started
Weaviate
Weaviate logoWeaviate · Feature trail

Google Modules Security Fix

1 post · Sep 2026

What this trail covers

This post details a critical security vulnerability fix in Weaviate's Google-backed modules (text2vec-google, multi2vec-google, generative-google). The vulnerability allowed for credential disclosure via an unvalidated apiEndpoint configuration, potentially exposing static API keys or live OAuth access tokens. The fix involves extending endpoint validation to the apiEndpoint field at both configuration and query parameter layers. This addresses a high-severity (CVSS 7.1) issue impacting versions prior to v1.39.3. Customers are advised to upgrade or disable affected modules. The post also mentions ongoing efforts to secure enterprise authentication and authorization, including API key management, OIDC integration, and RBAC.

All Weaviate trails
  1. Weaviate security release - High severity fix for credential disclosure in the Google modules | WeaviateThis post describes a specific security vulnerability in Weaviate's Google modules related to credential disclosure through an unvalidated `apiEndpoint`. It details the two attack vectors (collection configuration and GraphQL query parameter), the impact of credential exposure (static API keys or OAuth tokens), and the technical fix implemented: extending endpoint validation to the `apiEndpoint` field at both configuration and query parameter layers. It also references prior work on base URL validation and dial-time protection, highlighting why this specific `apiEndpoint` field was not covered. The CVSS score and impacted versions are provided, along with remediation steps (upgrade or disable modules).