Intel

AIKIDO-2025-10149

github.com/weaviate/weaviate is vulnerable to Race Condition

Race Condition Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Mar 13, 2025

55

Medium Risk

This Affects:

gogithub.com/weaviate/weaviate
1.28.3 - 1.28.8
Fixed in 1.28.9
1.29.0 - 1.29.0
Fixed in 1.29.1
Are you affected? Scan for Free

TL;DR

Affected versions of this package are affected by a race condition when creating roles that can lead to unauthorized role creation or privilege escalation due to the lack of validation checks for existing roles before creating new ones. An attacker can exploit this by rapidly submitting role creation requests, potentially creating duplicate or unauthorized roles, bypassing access controls, and gaining elevated privileges.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

github.com/weaviate/weaviate is vulnerable to Race Condition in versions 1.28.3 - 1.28.8 and 1.29.0 - 1.29.0.

How to fix this

Upgrade the github.com/weaviate/weaviate library to the patch version.