Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-65317 – SSRF via Origin Header Bypass – Weaviate Verba up to version 2.1.3

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-65317 is a Server-Side Request Forgery (SSRF) vulnerability combined with a same-origin middleware bypass in Weaviate’s Verba RAG application, affecting all versions up to and including 2.1.3. The flaw allows unauthenticated remote attackers to force the server to issue arbitrary outbound HTTP GET requests to attacker-controlled infrastructure. With a CVSS 4.0 score of 9.2 (Critical) and no patch available — the Verba project was archived in June 2026 — all deployed instances remain permanently vulnerable.

Technical details

  • Root cause: The API middleware’s same-origin validation check can be bypassed by supplying an Origin header value prefixed with a single quote (e.g., 'attacker.com). The flawed string-matching logic accepts any Origin value beginning with this character, regardless of the actual domain or port, allowing the attacker to pass the localhost origin guard.
  • Trigger conditions: No authentication, credentials, or user interaction are required. The attack is executable remotely over the network with low complexity (AC:L, AT:N, PR:N, UI:N per CVSS 4.0 vector).
  • Attack vector: An attacker sends a crafted HTTP request containing the malformed Origin header to the /api/connect endpoint, then supplies arbitrary host and port parameters. The application then issues outbound GET requests to the specified destination on behalf of the server.
  • Impact: The server is abused as an HTTP proxy, enabling internal network reconnaissance, interaction with cloud metadata services (e.g., AWS Instance Metadata Service for credential theft), probing of internal APIs and services not otherwise reachable from the internet, and using the server as a source for attacks on third-party systems. CVSS 4.0 metrics reflect high confidentiality impact on both the vulnerable component (VC:H) and downstream/subsequent systems (SC:H).

Affected software

  • Weaviate Verba versions 0 through 2.1.3 (all releases up to and including 2.1.3)

Severity

  • CVSS v3.1 Base Score: 8.6 (High)
  • CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  • CVSS v4.0 Base Score: 9.2 (Critical)
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
  • CWE: CWE-918 (Server-Side Request Forgery)

Mitigation and recommended actions

  • No patch available. The Verba project was officially archived and discontinued on June 8, 2026. The maintainers have confirmed no further updates, bug fixes, or security patches will be released. All deployed instances running any version up to and including 2.1.3 are permanently vulnerable.
  • Immediate action — decommission or isolate: Organizations running Verba should treat all instances as unremediable and immediately remove them from internet-facing exposure or shut them down entirely if no longer operationally required.
  • Network-level mitigation: If decommissioning is not immediately possible, apply strict network egress controls to block the Verba application server from initiating outbound connections to arbitrary hosts. Restrict inbound access to the /api/connect endpoint to trusted internal IP ranges only, using a web application firewall or perimeter firewall rules.
  • Asset inventory: Audit your environment for any Verba deployments, including those provisioned via one-click cloud platforms or Docker containers with externally exposed ports.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge