CVE-2026-65318: Verba RAG Application SSRF Vulnerability

CVE-2026-65318 Overview

CVE-2026-65318 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Verba, an open-source Retrieval-Augmented Generation (RAG) application maintained by Weaviate. Version 2.1.3 exposes the /ws/import_files WebSocket endpoint without authentication. Attackers can supply arbitrary URLs through the HTMLReader configuration and coerce the backend into issuing HTTP GET requests to attacker-chosen destinations. The flaw is tracked under CWE-918 and allows adversaries to reach internal services, co-located databases, and cloud instance metadata endpoints.

Critical Impact
Unauthenticated attackers can pivot into internal networks and retrieve cloud credentials from Instance Metadata Service (IMDS) endpoints, enabling account takeover of the hosting cloud environment.

Affected Products

Weaviate Verba (GoldenVerba) RAG application version 2.1.3
Deployments exposing the /ws/import_files WebSocket endpoint
Cloud-hosted Verba instances with access to IMDS or co-located data stores

Discovery Timeline

2026-07-21 - CVE-2026-65318 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65318

Vulnerability Analysis

Verba exposes a WebSocket route at /ws/import_files that accepts document import instructions from clients. The endpoint enforces no authentication or authorization checks before processing the request payload. When a client selects the HTMLReader importer, the backend fetches the URL provided in the configuration and parses its content for ingestion into the RAG pipeline.

Because the URL is fully attacker-controlled, the backend acts as a confused deputy. Attackers can direct the server to internal IP ranges, loopback services, or cloud metadata hosts such as 169.254.169.254. Response content from the fetched URL is returned through the WebSocket stream, leaking the retrieved data to the caller. This enables credential theft from cloud IMDS endpoints and reconnaissance of adjacent services like Weaviate databases running on the same host.

Root Cause

The root cause is the absence of two controls in the WebSocket import handler. First, the endpoint lacks authentication, allowing anonymous callers to invoke document import operations. Second, the HTMLReader fetch routine does not validate or restrict destination URLs against an allowlist, does not block private address ranges, and does not filter link-local metadata endpoints. The combination satisfies the classic SSRF pattern described in CWE-918.

Attack Vector

An attacker connects to ws://<verba-host>/ws/import_files over the network without credentials. The attacker sends an import job specifying HTMLReader with a URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS or http://metadata.google.internal/ on GCP. Verba fetches the URL server-side and returns the response body through the WebSocket. The attacker parses the returned credentials and uses them against the cloud provider API.

The vulnerability mechanism is described in the GitHub SSRF Finding and the VulnCheck Security Advisory. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-65318

Indicators of Compromise

Outbound HTTP GET requests from the Verba backend to link-local addresses such as 169.254.169.254 or metadata.google.internal.
WebSocket connections to /ws/import_files from unauthenticated or unexpected client IP addresses.
Import job payloads referencing HTMLReader with URLs pointing at RFC1918 ranges, 127.0.0.1, or co-located database ports.
Unusual spikes in outbound egress traffic from the Verba container or host.

Detection Strategies

Inspect application logs for HTMLReader import events and correlate the target URL against an allowlist of expected document sources.
Deploy network egress monitoring on the Verba host to alert on connections to cloud metadata endpoints.
Enable WebSocket-aware web application firewall rules that inspect and log frames sent to /ws/import_files.
Baseline normal document import volume and flag deviations that may indicate SSRF probing.

Monitoring Recommendations

Forward Verba application logs, container runtime telemetry, and cloud audit logs into a centralized data lake for correlation.
Monitor cloud IAM activity for use of instance role credentials from IP addresses outside the expected workload range.
Track process-level network connections from the Verba Python process to identify anomalous outbound destinations.

How to Mitigate CVE-2026-65318

Immediate Actions Required

Restrict network access to the Verba management interface and WebSocket endpoints to trusted administrators only.
Block outbound traffic from the Verba host to 169.254.169.254 and other cloud metadata endpoints at the network layer.
On AWS, enforce Instance Metadata Service Version 2 (IMDSv2) with a hop limit of 1 to defeat SSRF-based credential theft.
Rotate any cloud credentials, API keys, and database secrets accessible from the Verba host if exploitation is suspected.

Patch Information

No fixed version is identified in the enriched NVD record at the time of publication. Monitor the Weaviate Verba project repository for release notes addressing CVE-2026-65318 and apply upstream fixes as they become available.

Workarounds

Place Verba behind an authenticating reverse proxy that requires credentials before the /ws/import_files route is reachable.
Deploy Verba inside a network segment with no route to instance metadata services or internal databases.
Configure an egress proxy that enforces a URL allowlist for outbound HTTP requests originating from the Verba backend.
Disable or remove the HTMLReader importer if URL-based ingestion is not required for the deployment.

bash

# Configuration example: block IMDS access via iptables on the Verba host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 169.254.170.2 -j DROP

# AWS: enforce IMDSv2 with hop limit 1
aws ec2 modify-instance-metadata-options \
  --instance-id <instance-id> \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled