Vector store publicly exposed

ID

vector-store-publicly-exposed

Severity

critical

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

OWASP LLM

LLM08:2025 — Vector and Embedding Weaknesses

OWASP ASI

ASI03:2026 (secondary ASI06:2026)

Family

LLM08 — Vector and Embedding Weaknesses

Red-team vectors

RAG Poisoning, Data Exfil via Markdown

Tags

ai_security

Description

A vector store is reachable from the public internet with no authentication, or with no TLS. Every embedded document is readable and every index writable by anyone who finds the endpoint — the retrieval corpus becomes a public read/write surface. The Critical floor applies to the public-exposure combination: a private store without auth, or a public store with auth and TLS, is not flagged (internal plaintext belongs to the customer’s network-policy domain).

Evidence points to the endpoint / deployment declaration and states which control is missing, never echoing credentials.

Examples

store = Weaviate(url="http://0.0.0.0:8080")   (1)
1 Bound to all interfaces, plaintext (http://), no auth — flagged critical.

A public store with api_key=…​ and TLS, or a private local store, produces no finding.

Mitigation / Fix

  • Restrict the store to a private network; require authentication; enable TLS.

  • Never expose a vector store to the public internet unauthenticated.