CVE-2026-65317
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Verba RAG application version 2.1.3 contains a server-side request forgery (SSRF) vulnerability combined with a same-origin middleware bypass. An unauthenticated remote attacker can supply a crafted Origin header and attacker-controlled host and port values to force the server to issue arbitrary HTTP requests. The localhost origin check in the API middleware can be bypassed by sending any Origin value prefixed with 'localhost' regardless of port, then submitting arbitrary host and port parameters to the /api/connect endpoint, causing the server to issue outbound GET requests to attacker-controlled infrastructure.
Risk Assessment
An attacker can use the server to scan internal networks, access sensitive data, or launch attacks against other systems, potentially leading to data confidentiality and integrity breaches.
Recommendation
Immediately update Verba RAG to the latest version that fixes this vulnerability. Until then, restrict access to the /api/connect endpoint and implement Origin header validation.
Other vulnerabilities in Verba RAG
Original NVD description (English source)
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host and port values. Attackers can bypass the localhost origin check in the API middleware by sending any Origin value prefixed with ' regardless of port, then submit arbitrary host and port parameters to the /api/connect endpoint to cause the server to issue outbound GET requests to attacker-controlled infrastructure.