EXPOSURE Weaviate
SEVERITY CRITICAL
PROBE GET :8080/v1/meta
Is your Weaviate exposed?
Schema and every vector open, including stores that may hold agent memory, until you enable auth.
Scan a host you own → Fix card Census
Why it matters
Your Weaviate instance answers anyone: full schema and every stored vector readable, writable, poisonable and deletable — including stores that may hold agent memory (OWASP ASI06). Weaviate is wide open unless you turn on authentication.
How common is it?
1,335 Weaviate instances are reachable in the Shodan index. Fingerprint match, not a verified zero-auth count · src: Shodan count · `http.html:"https://weaviate.io"` · 2026-08
Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.
Fix it
The full walkthrough lives on the fix card, kept current in one place: