CVE-2026-65317 is a critical SSRF vulnerability in Weaviate Verba RAG application version 2.1.3. The vulnerability combines a same-origin middleware bypass with SSRF, allowing unauthenticated remote attackers to craft an Origin header prefixed with a single quote to bypass localhost origin checks. Attackers can then submit arbitrary host and port parameters to the /api/connect endpoint, causing the server to issue outbound HTTP GET requests to attacker-controlled hosts. This enables potential misuse of the server to access internal or external network resources without authentication.

An unauthenticated attacker can exploit this vulnerability to make the vulnerable server perform arbitrary HTTP requests to attacker-specified hosts and ports. This can lead to unauthorized internal network scanning, access to internal services, or interaction with attacker infrastructure, potentially facilitating further attacks or information disclosure. The CVSS 4.0 score of 9.2 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality and system control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable server to trusted networks only and monitor for unusual outbound requests from the server. Avoid exposing the /api/connect endpoint to untrusted networks. Follow vendor updates closely for an official patch or mitigation instructions.