CVE-2026-105145
Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 4, 2026
- Updated
- Oct 6, 2026
- Reserved
- Oct 3, 2026
Description
A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file goldenverba/components/util.py of the component generate_stream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
VerbaWeaviate |
|
References
- VDB-413370 | Weaviate Verba generate_stream Endpoint util.py get_environment information disclosurevdb-entrytechnical-description
- VDB-413370 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-105145 | CVE Analysis and Reportthird-party-advisory
- Submit #945744 | weaviate Verba <=2.1.3 Information Disclosurethird-party-advisory
- https://gist.github.com/DReazer/63d8096046a058f9c7a533846db5e2acexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.