CVE-2026-65317

Deferred Deferred - Pending Action

Server-Side Request Forgery in Verba RAG Application

Publication date: 2026-07-21

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host and port values. Attackers can bypass the localhost origin check in the API middleware by sending any Origin value prefixed with ' regardless of port, then submit arbitrary host and port parameters to the /api/connect endpoint to cause the server to issue outbound GET requests to attacker-controlled infrastructure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-23

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-65317

EUVD

EUVD-2026-46450

Affected Vendors & Products

Vendor	Product	Version / Range
verba	rags	2.1.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Verba RAG application version 2.1.3 has a server-side request forgery (SSRF) vulnerability combined with a same-origin middleware bypass. Unauthenticated attackers can exploit this by sending a crafted Origin header and attacker-controlled host and port values. This allows them to bypass localhost origin checks and force the server to make arbitrary HTTP requests to external systems under their control.

Detection Guidance

Detecting this SSRF vulnerability may involve monitoring for unusual outbound HTTP requests from the Verba RAG application, particularly to unexpected hosts or ports. Check server logs for requests to the /api/connect endpoint with crafted Origin headers or unusual host parameters. Network traffic analysis tools like tcpdump or Wireshark could help identify suspicious outbound connections originating from the application.

Impact Analysis

This vulnerability allows attackers to make the server issue outbound requests to internal or external systems. This could lead to data exfiltration, internal network scanning, or unauthorized access to sensitive services. The impact includes potential data breaches, service disruption, and compromise of backend systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately upgrade Verba RAG to a patched version if available. If not, restrict network access to the /api/connect endpoint using firewalls or network segmentation. Disable or remove the vulnerable functionality if unused. Implement strict input validation for Origin headers and host parameters. Monitor for exploitation attempts in logs.

Hi! I’m here to help you understand CVE-2026-65317. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70