CVE-2026-30858 - Vulnerability Analysis

Overview

WeKnora < 0.3.0 contains a DNS rebinding vulnerability caused by improper URL validation in the web_fetch tool, letting unauthenticated attackers access internal server resources, exploit requires crafted malicious domain resolving to private IP after validation.

Severity & Score

Impact

Unauthenticated attackers can access internal server resources and sensitive local services, potentially leading to data exfiltration.

Mitigation

Update to version 0.3.0 or later.

References

• https://github.com/Tencent/WeKnora/security/advisories/GHSA-h6gw-8f77-mmmp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner