CVE-2026-105145

MEDIUM 5.3

Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file goldenverba/components/util.py of the component generate_stream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-200 CWE-284
Vendor	weaviate
Product	verba
Published	Oct 4, 2026

Stay Ahead of the Next One

Get instant alerts for weaviate verba

Be the first to know when new medium vulnerabilities affecting weaviate verba are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Weaviate / Verba

2.1.0 2.1.1 2.1.2 2.1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/413370 vuldb.com: https://vuldb.com/vuln/413370/cti vuldb.com: https://vuldb.com/cve/CVE-2026-105145 vuldb.com: https://vuldb.com/submit/945744 gist.github.com: https://gist.github.com/DReazer/63d8096046a058f9c7a533846db5e2ac

Credits

🔍 Snkn0w (VulDB User) VulDB CNA Team