CVE-2026-11500

A vulnerability was identified in Weaviate up to 1.37.7. This vulnerability affects the function validateConfig of the file usecases/auth/authentication/apikey/client.go of the component Static API Key Handler. The manipulation of the argument StaticApiKey leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. Upgrading to version 1.38.0-rc.0 is able to resolve this issue. The identifier of the patch is 40f2cc32279f0f8a51016c3c6870a2c0c808e6c0. You should upgrade the affected component.

• CWE-285
• CWE-639

• https://github.com/weaviate/weaviate/
• https://github.com/weaviate/weaviate/commit/40f2cc32279f0f8a51016c3c6870a2c0c808e6c0
• https://github.com/weaviate/weaviate/issues/11392
• https://github.com/weaviate/weaviate/releases/tag/v1.38.0-rc.0
• https://vuldb.com/cve/CVE-2026-11500
• https://vuldb.com/submit/835080
• https://vuldb.com/vuln/369120
• https://vuldb.com/vuln/369120/cti

Published

Jun 8, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11494A security vulnerability has been detected in TOTOLINK AC120…4.3
• CVE-2026-11495A vulnerability was detected in CodeAstro Ingredients Stock …6.3
• CVE-2026-11497A vulnerability has been found in D-Link DCS-5615 1.01.00. A…8.8
• CVE-2026-11498A vulnerability was found in Tenda HG7HG9 and HG10 300001138…8.8
• CVE-2026-11499A vulnerability was determined in Tenda HG7HG9 and HG10 3000…9.8
• CVE-2026-1150A security flaw has been discovered in Totolink LR350 9.3.5u…8.8
• CVE-2026-11501A security flaw has been discovered in SourceCodester Hospit…7.3
• CVE-2026-11502A weakness has been identified in JeecgBoot up to 3.9.2. Imp…3.1
• CVE-2026-11503A security vulnerability has been detected in Tenda CX12L 16…8.8
• CVE-2026-11504A vulnerability was detected in Tenda CX12L 16.03.53.12. The…8.8
• CVE-2026-11505A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2…5
• CVE-2026-11506A vulnerability has been found in CodeAstro Leave Management…6.3