CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass

🗓️ 21 Jul 2026 21:31:01Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

Attackers can force the server to issue requests via Origin to /api/connect, bypassing same-origin.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-65317	21 Jul 202621:31	–	attackerkb
Circl	CVE-2026-65317	21 Jul 202623:00	–	circl
CVE	CVE-2026-65317	21 Jul 202621:31	–	cve
Cvelist	CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass	21 Jul 202621:31	–	cvelist
EUVD	EUVD-2026-46450	22 Jul 202600:32	–	euvd
NVD	CVE-2026-65317	21 Jul 202622:19	–	nvd
Positive Technologies	PT-2026-62414	21 Jul 202600:00	–	ptsecurity

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65317.json
github	www.github.com/geo-chen/oss/blob/main/verba.md
github	www.github.com/weaviate/Verba
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-65317
vulncheck	www.vulncheck.com/advisories/verba-goldenverba-server-side-request-forgery-via-api-connect-and-same-origin-middleware-bypass

22 Jul 2026 05:43Current

5.6Medium risk

Vulners AI Score5.6

CVSS 49.2

server side forgery same origin bypass origin header usage api connect endpoint unauthenticated access outbound requests