CVE-2026-65318: Server-Side Request Forgery (SSRF) in Weaviate Verba

CVE-2026-65318 is an unauthenticated SSRF vulnerability in Weaviate Verba 2.1.3. The vulnerability allows remote attackers to connect to the /ws/import_files WebSocket endpoint without authentication and specify arbitrary URLs in the HTMLReader configuration. This forces the backend to perform HTTP GET requests to attacker-supplied URLs, enabling access to internal network resources and sensitive information such as cloud instance metadata or database endpoints. The vulnerability is critical with a CVSS 4.0 score of 9.2 and has no known exploits in the wild or vendor-provided remediation information at this time.

Successful exploitation allows unauthenticated attackers to make the backend server perform arbitrary HTTP GET requests. This can lead to unauthorized access to internal resources, including co-located database endpoints and cloud instance metadata services, potentially exposing sensitive credentials and internal network information. The vulnerability poses a critical risk due to its unauthenticated nature and high impact on confidentiality and security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /ws/import_files WebSocket endpoint and monitor for suspicious requests. Implement network-level controls to prevent the backend server from making unauthorized outbound HTTP requests to internal resources. Follow vendor updates closely for an official patch or mitigation.