Weaviate is a vector database with REST and GraphQL interfaces. Its documentation states that anonymous access is enabled by default in Docker and that requests without explicit authentication run as the anonymous user. The setting is intended for development and evaluation. A deployment that keeps the default after it begins holding production data has an authorization problem regardless of the number of internet matches.
A count-only ZoomEye measurement on 2026-10-29 returned 59 matches for title="Weaviate" and 0 for app="Weaviate". Both used sub_type=all, page 1, and page size 1. The title result is the selected discovery query. These are matching observations, not confirmed anonymous deployments or exposed records. The zero application result is not proof that Weaviate is absent from the internet.
Check authentication and authorization separately
Weaviate documentation lists API key, OpenID Connect, and anonymous access as authentication modes. When anonymous access is on, a request without credentials is authenticated as user: anonymous. Authorization then determines what that user can do. If authentication is disabled or an anonymous user has broad permissions, the database is reachable by a larger population than the owner intended.
RBAC is the recommended production authorization model. Roles can constrain access at the collection, tenant, and operation level. Authentication identifies a principal; RBAC decides which classes, objects, and tenants that principal can read or change. A deployment that enables an API key but gives every key root-level access still has a broad authorization boundary.
Review the configuration variables that control anonymous access, API keys, OIDC, and RBAC together. The authorization guide warns that undifferentiated access is suitable only for development or a trusted single-user environment. For a multi-tenant service, test a user against a collection and tenant that belongs to another user. Do not infer tenant isolation from collection naming.
Use product evidence with care
The title query can identify a page that mentions Weaviate, a documentation site, a login screen, or a service operator. Validate the candidate through an owned hostname, a product route, or a cloud asset record. The application field returned zero, so a title-only candidate needs more corroboration before an analyst treats it as a Weaviate API.
A reverse proxy can hide the backend product fingerprint while still forwarding the API. That is one reason a zero app count should not be used as a negative inventory control. Use internal configuration management and cloud discovery as complementary sources. If an external endpoint is discovered, compare it with the expected listener, authentication provider, and network boundary.
Record the query as a measurement, not a statement of affectedness. The match count can change when pages are updated or when ZoomEye's observations change. A useful record keeps the exact query, date, result, unit, and scope, then links it to the owner and the internal test result.
A practical Weaviate review
For each owned cluster, confirm AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED is false in production unless an explicit public-read use case exists. Enable API key or OIDC authentication and configure RBAC. Remove the root key from client applications and give each service a role scoped to its collections and tenants.
Test anonymous requests and low-privilege requests against read, write, delete, backup, and schema operations. Verify that a user with access to one collection cannot see the existence of another, or at least cannot read its objects or metadata. Check the health and metrics endpoints separately. If they are intentionally internal, keep them off the public listener.
Add monitoring for anonymous requests, authentication failures, unexpected schema changes, and bulk reads. A request count is not proof of misuse, but a sudden rise in anonymous activity can give an owner a reason to inspect the deployment. If anonymous access is enabled by accident, turn it off and rotate any credentials that were reachable from the same network.
Weaviate's default is easy to carry from a demo into production. Discovery helps find candidates, but the decisive evidence is the running authentication and authorization configuration. A 59-match title set is not a vulnerability count. It is a reason to ask whether any owned cluster still behaves like a development instance.