VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Sep 15, 2026

CVE-2026-91750

CVE-2026-91750

Description

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Tencent/Weknorareferences2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: <0.7.0

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.