Weaviate security release - High severity fix for credential disclosure in the Google modules | Weaviate

This post describes a specific security vulnerability in Weaviate's Google modules related to credential disclosure through an unvalidated `apiEndpoint`. It details the two attack vectors (collection configuration and GraphQL query parameter), the impact of credential exposure (static API keys or OAuth tokens), and the technical fix implemented: extending endpoint validation to the `apiEndpoint` field at both configuration and query parameter layers. It also references prior work on base URL validation and dial-time protection, highlighting why this specific `apiEndpoint` field was not covered. The CVSS score and impacted versions are provided, along with remediation steps (upgrade or disable modules).