TI-2026-61973 Aliases CVE-2026-91750 GHSA-hvpp-w3x6-m653

WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

MEDIUM 64CWE-918Published 2026-09-15 · Updated 2026-09-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00436 38th percentileScored 2026-11-07

Fix Fixed WeKnora (Tencent): 0.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Tencent	WeKnora	0.5.2 to before 0.7.0	0.7.0	Patch available	CNA

WeKnora VendorTencent Affected 0.5.2 to before 0.7.0 Fixed in 0.7.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:tencent:weknora::::::::	—	—	Tencent

cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:* Versions — — ·Tencent

Remediation

Fix · CNA WeKnora (Tencent) Fixed in 0.7.0

Timeline

2026-10-02 Threatist record created from CVE-2026-91750
2026-10-03 Alias added: GHSA-hvpp-w3x6-m653

References

Patch 1

https://github.com/Tencent/WeKnora/commit/1d322c525a6197d24f07555b4b18ad33313b4328

Other 3

TI-2023-14243 vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and… CVSS 3.1CRITICAL 9.8
TI-2026-23690 WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation CVSS 3.1CRITICAL 10.0
TI-2026-23689 WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool CVSS 3.1CRITICAL 10.0
TI-2026-18215 WeKnora has Command Injection in MCP stdio test CVSS 3.1CRITICAL 10.0
TI-2026-18214 WeKnora vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
TI-2026-23684 WeKnora: Broken Access Control in Tenant Management CVSS 3.1HIGH 8.8

See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences