{"type":"post","id":"weaviate-security-release-medium-severity-fix-for-a-e0cb9c","slug":"weaviate-security-release-medium-severity-fix-for-a-e0cb9c","title":"Weaviate security release - Medium severity fix for a cross-collection vector disclosure in nearObject (CVE pending assignment)","description":"**Thesis:** Collection-level authorization is only meaningful when every lookup path enforces it before protected data is loaded.","retrieval_nugget":"**Thesis:** Collection-level authorization is only meaningful when every lookup path enforces it before protected data is loaded.","published_at":"2026-10-15","updated_at":"2026-10-15","record_date":"2026-10-15","date_kind":"published_at","topics":["security"],"source_urls":["https://weaviate.io/blog/weaviate-security-release-nearobject-2026"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:weaviate-security-release-medium-severity-fix-for-a-e0cb9c","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:582182907f5728f722e7f2af195d54e253939b85c4055eb8320d2e700fb4b3ce","reviewed_at":"2026-10-15T23:07:15.668Z","source_evidence_count":1,"verified_claim_count":4,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":4,"implication_count":3,"watch_condition_count":1,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Collection-level authorization is only meaningful when every lookup path enforces it before protected data is loaded.","observed_facts":[{"text":"Weaviate says versions earlier than v1.39.3 are affected, and v1.39.3 fixes the issue.","source_urls":["https://weaviate.io/blog/weaviate-security-release-nearobject-2026"]},{"text":"The vulnerable nearObject path checked authorization on the searched collection but not on the beacon-target collection before loading its vector.","source_urls":["https://weaviate.io/blog/weaviate-security-release-nearobject-2026"]},{"text":"The reporter demonstrated recovery of a normalized four-dimensional vector to within 5e-9 using eight probe objects.","source_urls":["https://weaviate.io/blog/weaviate-security-release-nearobject-2026"]},{"text":"Weaviate says it has no indication of exploitation and that CVE assignment is pending.","source_urls":["https://weaviate.io/blog/weaviate-security-release-nearobject-2026"]}],"mechanism":"The nearObject operator loaded a vector from the beacon-named collection without authorizing that collection. A caller could place chosen probe vectors in a collection it controlled and use returned distances to reconstruct the protected vector. The fix authorizes the beacon target at the shared vector lookup before loading it.","why_now":"Weaviate disclosed the issue with v1.39.3 and identified earlier versions as affected, making the upgrade boundary and mitigation immediately actionable.","implications":["Operators with collection-level RBAC in shared clusters should upgrade to v1.39.3 or later.","Before upgrading, operators should review which roles have read_collections and create_data permissions.","Authorization should be enforced at the shared lookup boundary so API surfaces cannot bypass it."],"evidence_boundary":"The supplied public disclosure describes a working reproduction and says Weaviate has no indication of exploitation. It does not establish exploitation in customer environments; CVE assignment is pending.","watch_conditions":["Track the pending CVE assignment and any later changes to affected-version scope or exploitation assessment."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied; this disclosure starts a distinct record about authorization checks at shared vector lookup boundaries."},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/weaviate-security-release-medium-severity-fix-for-a-e0cb9c/","markdown":"https://newruntime.com/posts/weaviate-security-release-medium-severity-fix-for-a-e0cb9c.md","json":"https://newruntime.com/posts/weaviate-security-release-medium-severity-fix-for-a-e0cb9c.json"},"related_patterns":["agent-security-moves-to-runtime-boundaries"],"next_reads":[{"type":"topic","path":"/topics/security/","url":"https://newruntime.com/topics/security/","title":"Security","reason":"Explore the security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/security.md","json_url":"https://newruntime.com/topics/security.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}