A flaw in Weaviate’s validateConfig function within the Static API Key Handler allows an attacker to manipulate the StaticApiKey argument, resulting in the bypass of authentication checks. The vulnerability can be triggered remotely and requires the attacker to supply crafted input to the API key validation routine. While the complexity of exploitation is high and the method is considered difficult, the existence of a publicly available exploit increases the risk. The vulnerability impacts confidentiality and integrity by permitting unauthorized access to protected resources that are otherwise gated by static API keys.

The affected product is Weaviate, a data management platform. Versions up to and including 1.37.7 are vulnerable. A fix is available in release 1.38.0-rc.0 and later, which incorporates the commit that addresses the issue.

The CVSS score of 2.3 classifies this vulnerability as low severity, and it is not listed in the CISA KEV catalog. EPSS data are not available, so the probability of exploitation remains uncertain. The attack vector is remote, inferred from the description. Although the enforcement of authentication can be bypassed, the high effort required and the absence of a widespread public exploit mitigate immediate risk, but the vulnerability should still be remediated promptly.