CVE-2026-65318: Weaviate Verba

High severity, CVSS 8.6. EPSS: 0.6% chance of exploitation in the next 30 days.

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can connect to the /ws/import_files WebSocket endpoint without authentication, specify arbitrary URLs in the HTMLReader configuration, and cause the server to fetch internal resources such as co-located database endpoints or cloud instance metadata services to retrieve sensitive credentials.

Affected products

• Weaviate Verba: up to and including 2.1.3

Published 2026-07-21. Last modified 2026-07-23.