unauth

← fix library

CRITICAL Weaviate: Weaviate vector database open without authentication

Why it matters

Your Weaviate instance answers anyone: full schema and every stored vector readable, writable and deletable. Weaviate is wide open unless you turn on authentication.

Fix it — 3 steps

  1. Enable authentication: set `AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED=false` and configure API keys (OIDC or static) in your Weaviate config, then restart.
  2. If it is backend-only, unpublish the port: bind 127.0.0.1 or `sudo ufw deny 8080`.
  3. Check the audit logs if it was open for a while: assume the data was read.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:8080/v1/schema  # should return 401/403 or be unreachable

References

Not sure if your stack is exposed?

Run the free check — 30 seconds, safe read-only probes.

Scan your stack