CVE-2026-65317

Name of the Vulnerable Software and Affected Versions Verba RAG application version 2.1.3

Description A server-side request forgery (SSRF) issue combined with a same-origin middleware bypass allows unauthenticated remote attackers to force the server to issue arbitrary HTTP requests. By providing a crafted Origin header and controlling the host and port values, attackers can bypass the localhost origin check in the API middleware. This is achieved by sending any Origin value prefixed with a single quote ('), regardless of the port. Subsequently, submitting arbitrary host and port parameters to the '/api/connect' endpoint causes the server to send outbound GET requests to attacker-controlled infrastructure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.