CVE-2026-65318 is an unauthenticated SSRF vulnerability in Weaviate Verba version 2.1.3. The vulnerability exists because the /ws/import_files WebSocket endpoint accepts attacker-controlled URLs in the HTMLReader configuration without authentication or proper validation. This allows remote attackers to cause the backend server to make arbitrary HTTP GET requests, including to internal services that may expose sensitive credentials or data. The CVSS 4.0 base score is 9.2, reflecting high impact and ease of exploitation without privileges or user interaction.

Successful exploitation allows unauthenticated attackers to make the backend server perform arbitrary HTTP GET requests, potentially accessing internal resources such as co-located database endpoints or cloud instance metadata services. This can lead to disclosure of sensitive credentials and internal information, posing a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /ws/import_files WebSocket endpoint to trusted users or networks, and monitor for suspicious requests targeting this endpoint. Avoid exposing this endpoint publicly if possible.