CVE-2026-65318
Verba RAG application version 2.1.3 contains an unauthenticated server‑side request forgery vulnerability. Attackers can send arbitrary URLs through the /ws/import_files WebSocket endpoint, causing the backend to fetch internal resources. This can expose sensitive credentials without any authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Organizations using Verba RAG 2.1.3.
Real-world impact
An attacker can trigger the server to retrieve internal resources such as database endpoints or cloud instance metadata services, potentially exposing confidential credentials and other sensitive data.
Why this severity
The CVSS score of 9.2 reflects the critical nature of the flaw: it is unauthenticated, allows arbitrary server‑side requests, and can expose highly confidential data. The lack of authentication and the ability to target internal resources contribute to the high impact.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources