WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources
Description
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in the web_fetch tool allows an unauthenticated attacker to bypass URL validation and access internal resources on the server, including private IP addresses (e.g., 127.0.0.1, 192.168.x.x). By crafting a malicious domain that resolves to a public IP during validation and subsequently resolves to a private IP during execution, an attacker can access sensitive local services and potentially exfiltrate data. This issue has been patched in version 0.3.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/Tencent/WeKnoraGo | < 0.3.0 | 0.3.0 |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/tencent/weknorapkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
< 0.3.0+ 1 more
- (no CPE)range: < 0.3.0
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-h6gw-8f77-mmmpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-30858ghsaADVISORY
- github.com/Tencent/WeKnora/security/advisories/GHSA-h6gw-8f77-mmmpghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.