Weaviate patches its whole estate in 17 hours after eMudhra certificate leak
Weaviate says it patched its entire customer estate and infrastructure platform in less than 17 hours to reduce the risk from eight leaked certificates issued by the certificate authority eMudhra. According to the company, Enterprise customers were patched within six hours.
- Weaviate patched its customer estate and infrastructure after eight eMudhra certificates leaked.
- The full process took less than 17 hours, according to Weaviate.
- Enterprise customers were patched within six hours.
- The environment was rolled to Go version 1.27.3.
- Engineering, platform, agents and support teams worked together on the effort.
What Weaviate did
In a blog post, the engineering team at Weaviate, the vector database company, described its response to the eMudhra certificate compromise. The company says it patched its whole customer estate and infrastructure platform to mitigate the risk posed by eight leaked certificates from the certificate authority.
The fix involved rolling almost every part of the environment to Go version 1.27.3. Weaviate states that the end-to-end process took less than 17 hours, and that its Enterprise customers were patched within six hours.
A cross-team effort
Weaviate says the speed of the response was only part of the story. A task force drawn from all its engineering teams handled the work: core developers, console, platform and agents teams, together with the product support function. According to the company, the group coordinated the rollout as one team.
The post describes the steps involved: the team created and reviewed pull requests, pushed tags, watched promotions and saw the tests of its services pass. Weaviate also says the security and reliability of its database are paramount, and that customer trust is built on that foundation.
The company also praised its engineers, from the applied research team to platform engineers who manage compute, security, observability and deployment infrastructure across three cloud providers.
Security reporting and recent releases
The post repeats Weaviate's process for reporting vulnerabilities. Anyone who believes they have found one is directed to the company's Security Report page. Weaviate says it will contact the reporter to acknowledge the report and advise on next steps. It asks researchers not to disclose vulnerabilities publicly until they have been fixed and announced, unless the Weaviate security team has said they may.
The post links to other recent security notices. On October 15, 2026, Weaviate published a release note on a medium-severity fix for a cross-collection vector disclosure in the nearObject operator, with the CVE pending assignment. On October 1, 2026, it published a note on a high-severity fix for credential disclosure in the Google modules. Both are listed as fixed in Weaviate v1.39.3.
What it means for customers
The source gives no details on how the certificates leaked or on any exploitation. What it does show is the timeline Weaviate claims: a full-estate patch in under 17 hours and Enterprise customers covered within six. For users of Weaviate, the practical message is that the company reports having already updated its environment to Go 1.27.3, so the post itself does not ask customers to take further action.
Weaviate: How Weaviate responded to the eMudhra certificate compromise
