This vulnerability in Weaviate up to version 1.37.7 involves the Static API Key Handler's validateConfig function in the file usecases/auth/authentication/apikey/client.go. By manipulating the StaticApiKey argument, an attacker can bypass authorization controls. The attack can be performed remotely but has a high complexity and is difficult to exploit. Although an exploit is publicly available, no known exploits in the wild have been reported. Upgrading to Weaviate version 1.38.0-rc.0 resolves the issue, with the patch identified by commit 40f2cc32279f0f8a51016c3c6870a2c0c808e6c0.

Successful exploitation allows an attacker to bypass authorization mechanisms in Weaviate, potentially granting unauthorized access to protected resources or operations. However, the low CVSS score (2.3) and high attack complexity indicate limited impact and difficulty in exploitation. No known active exploitation has been reported.

Upgrade Weaviate to version 1.38.0-rc.0 or later, which contains the official fix for this vulnerability. Since the vulnerability is resolved in this version, no additional mitigation steps are required.