Search: CVE-2026-28490

A cryptographic padding oracle vulnerability (CVE-2026-28490) exists in the Authlib Python library used by weaviate-cli, related to the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib disables the Bleichenbacher padding oracle mitigation implemented by the underlying cryptography library by raising a distinct exception on invalid padding, creating a reliable exception oracle. This vulnerability is active by default without special configuration and affects versions >=3.0.2 and <3.3.0_3 of weaviate-cli. A fix is available in version 3.3.0_3.