CVE-2026-65317: Weaviate Verba

High severity, CVSS 8.6. EPSS: 0.6% chance of exploitation in the next 30 days.

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host and port values. Attackers can bypass the localhost origin check in the API middleware by sending any Origin value prefixed with ' regardless of port, then submit arbitrary host and port parameters to the /api/connect endpoint to cause the server to issue outbound GET requests to attacker-controlled infrastructure.

Affected products

• Weaviate Verba: up to and including 2.1.3

Published 2026-07-21. Last modified 2026-07-23.