Description

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in the web_fetch tool allows an unauthenticated attacker to bypass URL validation and access internal resources on the server, including private IP addresses (e.g., 127.0.0.1, 192.168.x.x). By crafting a malicious domain that resolves to a public IP during validation and subsequently resolves to a private IP during execution, an attacker can access sensitive local services and potentially exfiltrate data. This issue has been patched in version 0.3.0.

INFO

Published Date :

2026-03-07T16:34:28.528Z

Last Modified :

2026-03-09T18:24:21.174Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-30858 vulnerability.

Vendors Products
Tencent
  • Weknora
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-30858.

URL Resource
https://github.com/Tencent/WeKnora/security/advisories/GHSA-h6gw-8f77-mmmp cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact