{"slug": "weaviate-security-release-high-severity-fix-for-credential-disclosure-in-the", "title": "Weaviate security release - High severity fix for credential disclosure in the Google modules", "summary": "Weaviate released v1.39.3 to fix a high severity credential disclosure vulnerability, rated CVSS 7.1, in its Google-backed modules text2vec-google, multi2vec-google and generative-google, where an unvalidated apiEndpoint value was written into the outbound request host while the operator's Google credential was attached as a bearer token. A CVE has been requested from MITRE and is pending assignment. The more serious path let generative-google accept apiEndpoint as an inline GraphQL query parameter that overrode the collection default with only ordinary read access, exposing either a static API key or, when USE_GOOGLE_AUTH is enabled, a live OAuth access token scoped to cloud-platform; Weaviate Cloud and Marketplace customers on AWS, Azure and GCP have been patched, and versions below v1.39.3 are impacted.", "body_md": "## Intro\n\nWeaviate `v1.39.3` includes a fix for a high severity credential disclosure vulnerability in Weaviate's Google-backed modules, where an unvalidated endpoint setting could be used to redirect an outbound request, and the operator's Google credential with it, to an arbitrary host. A CVE has been requested from MITRE and is pending assignment; we will update this post with the CVE ID once it has been issued.\n\nAs per our security policy, Weaviate customers running in Weaviate Cloud, and Marketplace customers on AWS, Azure and GCP have been patched seamlessly. Our Weaviate Enterprise Support customers have received early notification under embargo, and our customer-facing teams are working with Weaviate Dedicated customers to organize version upgrades where appropriate.\n\n## Credential disclosure via unvalidated apiEndpoint in the Google modules (CVE pending assignment)\n\nWeaviate's Google-backed modules (`text2vec-google`, `multi2vec-google` and `generative-google`) allow the host used for outbound Vertex AI and Gemini requests to be set through an `apiEndpoint` configuration value. That value was written directly into the host portion of the request URL without validation, and the operator's configured Google credential was attached to the request as a bearer token regardless of where the request was being sent. A user who can influence `apiEndpoint` could therefore cause Weaviate to deliver that credential to a host of their choosing.\n\nThere were two paths to setting the value:\n\n1. Through collection configuration. Setting `moduleConfig.text2vec-google.apiEndpoint` (or the equivalent for the other two modules) when creating or updating a collection. Validation at this layer checked only that a project ID was present; the endpoint string itself was never checked. This path requires schema-write privileges.\n2. Through a GraphQL query parameter. `generative-google` accepted`apiEndpoint` as an inline parameter on a generative query, and the per-query value overrode the collection default. This path requires only ordinary read access to a collection already configured to use`generative-google` , with no schema-write privilege and no change to stored configuration.\n\nThe second path is the more serious of the two, and is the main reason for the severity rating.\n\nThe credential exposed depends on how the deployment authenticates to Google. Where a static API key is configured, that key is disclosed. Where `USE_GOOGLE_AUTH` is enabled, the disclosed value is a live OAuth access token scoped to `cloud-platform`, which is broad enough to reach most Google Cloud APIs available to the underlying service account. This is the documented way to run Vertex AI vectorization using Google Cloud Application Default Credentials, and the usual arrangement for GKE deployments using Workload Identity.\n\nThis is a distinct code path from the base URL validation added in earlier releases. That work hardened the endpoint fields of a large number of other model providers, but those fields are named `baseURL`; the Google modules' field is named `apiEndpoint` and was not covered. The related dial-time protection is also opt-in via `MODULES_VALIDATE_BASE_URL` and blocks only loopback, private and link-local addresses, so it does not prevent a credential being sent to an attacker-controlled host on the public internet.\n\nThe fix extends endpoint validation to the `apiEndpoint` field in all three Google modules, at both the configuration-validation layer and the GraphQL query-parameter layer.\n\nThe CVSS score for this vulnerability is High (7.1).\n\nImpacted versions of Weaviate are < `v1.39.3`. We recommend that impacted users update their Weaviate installations to `v1.39.3` or later to fully address the vulnerability. Until you can upgrade, the affected modules can be disabled by removing `text2vec-google`, `multi2vec-google` and `generative-google` from the `\"enabled_modules\"` flag. Where the modules are required, we recommend restricting schema-write and query access to collections configured to use them, and scoping the service account used for Vertex AI as narrowly as your workload allows rather than relying on a broad `cloud-platform` scope.\n\nWe have no indication that this vulnerability has been exploited.\n\n## Acknowledgements\n\nThis vulnerability was discovered and reported by Syed Anas Mohiuddin, an independent security researcher, who notified us through our Vulnerability Disclosure Program. We would like to thank him for the detail and care of the report, and for working with us through validation and remediation.\n\n## Reporting Security Issues\n\nIf you think you have found a security vulnerability, please go to our [Security Report page](https://weaviate.io/security-report) to learn how to send us a report. Weaviate will contact you to acknowledge your report, and advise on next steps. We ask that researchers do not disclose vulnerabilities publicly until they have been fixed and announced, unless you have received a response from the Weaviate security team that you can do so.\n\n## Ready to start building?\n\nCheck out the [Quickstart tutorial](https://docs.weaviate.io/weaviate/quickstart), or [sign up for a free Weaviate Cloud account](https://console.weaviate.cloud/?utm_source=blog&utm_medium=website&utm_campaign=blog_signup&utm_content=weaviate-security-release-googlemodules-2026&utm_term=ready-to-start-building).", "url": "https://wpnews.pro/news/weaviate-security-release-high-severity-fix-for-credential-disclosure-in-the", "canonical_source": "https://weaviate.io/blog/weaviate-security-release-googlemodules-2026", "published_at": "2026-10-01 00:00:00+00:00", "updated_at": "2026-10-29 15:17:44.475857+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "ai-tools"], "entities": ["Weaviate", "Google", "Vertex AI", "Gemini", "MITRE", "AWS", "Azure", "GCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/weaviate-security-release-high-severity-fix-for-credential-disclosure-in-the", "markdown": "https://wpnews.pro/news/weaviate-security-release-high-severity-fix-for-credential-disclosure-in-the.md", "text": "https://wpnews.pro/news/weaviate-security-release-high-severity-fix-for-credential-disclosure-in-the.txt", "jsonld": "https://wpnews.pro/news/weaviate-security-release-high-severity-fix-for-credential-disclosure-in-the.jsonld"}}