CVE-2026-105145

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function getenvironment of the file goldenverba/components/util.py of the component generatestream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack...

CVE-2026-105145 Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function getenvironment of the file goldenverba/components/util.py of the component generatestream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack...

EUVD-2026-92090

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function getenvironment of the file goldenverba/components/util.py of the component generatestream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack...

CVE-2026-105145

A vulnerability exists in Weaviate Verba up to version 2.1.3 within the generate_stream endpoint. Specifically, the get_environment function in the file goldenverba/components/util.py is affected, allowing for information disclosure through manipulation. This vulnerability can be exploited remote...

CVE-2026-105145 Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function getenvironment of the file goldenverba/components/util.py of the component generatestream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack...

CVE-2026-105145: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function getenvironment of the file goldenverba/components/util.py of the component generatestream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack...

PT-2026-104620

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get environment of the file goldenverba/components/util.py of the component generate stream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attac...

Verba (The Golden RAGtriever) Panel - Detect

Verba, also known as "The Golden RAGtriever", an open-source retrieval-augmented generation RAG chat application built by Weaviate that ships a Next.js frontend backed by a FastAPI/uvicorn server and is commonly deployed on port 8000, was detected via a unique compiled CSS class name present in t...

EUVD-2026-47015

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65318 Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65318 Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65318 Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65317

Verba RAG application 2.1.3 is affected by a server-side request forgery (SSRF) vulnerability combined with a same-origin middleware bypass. An unauthenticated attacker can issue arbitrary outbound HTTP requests by supplying a crafted Origin header and attacker-controlled host/port values to the ...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...