PT-2026-23801 · Weknora+1 · Weknora+1
Aleister1102
·
Published
2026-03-06
·
Updated
2026-03-25
·
CVE-2026-30858
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
WeKnora versions prior to 0.3.0
Description
WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval, contains a DNS rebinding issue in the
web fetch tool. An unauthenticated attacker can bypass URL validation and access internal resources on the server, including private IP addresses like 127.0.0.1 and 192.168.x.x. This is possible by crafting a malicious domain that initially resolves to a public IP address during validation and then resolves to a private IP address during execution. The web fetch tool lacks complete DNS pinning, performing URL validation only once via the validateParams() function. The original URL is then passed unchanged to the fetchHTMLContent() function, which ultimately calls fetchWithChromedp(). The headless browser (Chromedp) independently resolves the hostname without DNS pinning, creating a time-of-check-time-of-use (TOCTOU) condition. The vulnerability allows access to sensitive local services and potential data exfiltration.Recommendations
Update WeKnora to version 0.3.0 or later.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Chromedp
Weknora