Verba RAG application 2.1.3 is vulnerable to a server‑side request forgery amplified by a bypass of the same‑origin middleware. An attacker can supply an Origin header beginning with a single quote, tricking the middleware into believing the request originates from a trusted source. The client then submits crafted host and port values to the /api/connect endpoint, causing the server to issue outbound GET requests to attacker‑controlled infrastructure. This allows the attacker to direct the application to arbitrary URLs, potentially causing data exfiltration, unauthorized system interaction, or other unintended network behavior.

The vulnerability exists in the Weaviate:Verba product, specifically the Verba RAG application version 2.1.3. No other product or version identifiers were listed in the CNA package, so only this version is known to be affected.

The CVSS score of 9.2 indicates a high severity with full confidentiality and integrity impact. The EPSS score of less than 1% suggests that while the vulnerability is rarely exploited today, the attack vector is trivial: an unauthenticated HTTP request with a crafted header. The issue is not included in the CISA KEV catalog, but the combination of an unauthenticated entry point and the ability to direct the server to any destination warrants immediate attention.