What’s Vulnerable › Vulnerabilities

CVE-2026-65318: Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-10-24
• Weakness: CWE-918

Description

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can connect to the /ws/import_files WebSocket endpoint without authentication, specify arbitrary URLs in the HTMLReader configuration, and cause the server to fetch internal resources such as co-located database endpoints or cloud instance metadata services to retrieve sensitive credentials.

Affected products

• Weaviate Verba: through 2.1.3

References

• https://github.com/geo-chen/oss/blob/main/verba.md#finding-1-unauthenticated-ssrf-in-verba-websocket-import-endpoint-htmlreader
• https://github.com/weaviate/Verba
• https://www.vulncheck.com/advisories/verba-goldenverba-unauthenticated-server-side-request-forgery-via-websocket-import-endpoint-htmlreader
• https://github.com/geo-chen/oss/blob/main/verba.md#finding-1-unauthenticated-ssrf-in-verba-websocket-import-endpoint-htmlreader

Get alerted when CVE-2026-65318 or the next vulnerability affects your stack