CVE-2026-65317: Server-Side Request Forgery (SSRF) in Weaviate Verba

CVE-2026-65317 is a server-side request forgery vulnerability in Weaviate Verba RAG application version 2.1.3. The vulnerability arises from a same-origin middleware bypass that allows unauthenticated attackers to manipulate the Origin header with a prefix of a single quote character, bypassing localhost origin checks. This enables attackers to supply arbitrary host and port values to the /api/connect endpoint, causing the server to issue outbound HTTP GET requests to attacker-controlled infrastructure. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 9.2, reflecting critical impact on confidentiality and security controls. No vendor advisory or patch information is currently provided.

Successful exploitation allows unauthenticated remote attackers to cause the vulnerable server to make arbitrary HTTP requests to attacker-specified hosts and ports. This can lead to information disclosure, internal network scanning, or interaction with internal services not normally accessible externally. The vulnerability bypasses same-origin checks, increasing the risk of SSRF attacks. The critical CVSS score indicates a high impact on confidentiality and security controls, with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network egress from the affected server to limit outbound HTTP requests, and monitor for unusual outbound traffic patterns. Avoid exposing the vulnerable version 2.1.3 of Weaviate Verba to untrusted networks. Follow vendor communications for updates on patches or official mitigations.