← fix library

Why it matters

The port where your vectors actually live — Weaviate's gRPC data plane on :50051 — accepts connections from the internet, and the same host was confirmed to be Weaviate. This was measured by a zero-byte TCP connect, so it proves reachability, not that your data is readable: whether gRPC auth or TLS stands behind the open port was not tested. But Weaviate is wide open unless you turned on authentication, so an open :50051 usually means every vector readable and writable, including stores that may hold agent memory (OWASP ASI06) — treat it as exposed until proven otherwise.

Fix it — 3 steps

1. Take the data plane off the internet: bind :50051 to the VPC/loopback only or block it at the firewall — e.g. sudo ufw deny 50051. This is the gRPC port, not the HTTP :8080 one.
2. Enable authentication so an open port is not an open database: set AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED=false and configure API keys (OIDC or static), then restart.
3. If clients cross untrusted networks, put the gRPC endpoint behind TLS — credentials otherwise travel in the clear.

Verify it’s fixed

nc -z -w 3 YOUR_SERVER_IP 50051  # should time out or refuse, not print succeeded/open

References

• https://weaviate.io/developers/weaviate/configuration/authentication
• https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/