CVE-2026-91750— WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
Quick assessment
Affected
Tencent WeKnora
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WeKnora 在 0.7.0 之前的版本中，在通过 端点从用户提供的 URL 下载文档时，未能重新验证 HTTP 重定向的目标地址。经过认证的恶意用户可以利用指向内网地址的公共 URL 来绕过初始的 SSRF 验证，从而实现对内部服务和云元数据的访问。
Possible ATT&CK Techniques 1 AI
T1071.002 · File Transfer Protocols
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91750
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
Source: CVE Program / CVE List V5
Vulnerability Description
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-91750
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91750
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-91750 (2)
Vendor Advisories for CVE-2026-91750 (1)
-
🔗 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects | Advisories | VulnCheck third-party-advisory
Proof of Concept for CVE-2026-91750 (1)
IV. Related Vulnerabilities
Same product: WeKnora
-
CVE-2026-8786
Tencent WeKnora Config API Endpoint initialization.go getKno -
CVE-2026-30861
WeKnora: Remote Code Execution (RCE) via Command Injection i -
CVE-2026-30860
WeKnora: Remote Code Execution via SQL Injection Bypass in A -
CVE-2026-30859
WeKnora: Broken Access Control - Cross-Tenant Data Exposure -
CVE-2026-30858
WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allow
Same vendor: Tencent
-
CVE-2026-84809
Tencent AI-Infra-Guard skill-scan Analysis Bypass via Exclud -
CVE-2026-72565
Tencent APIJSON - Unauthenticated SQL Injection via @having -
CVE-2026-50144
ncnn: Out-of-bounds heap write in ParamDict::load_param via -
CVE-2026-15515
Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled -
CVE-2026-8786
Tencent WeKnora Config API Endpoint initialization.go getKno
Same weakness: CWE-918
-
CVE-2026-91199
Refly through 1.1.0 Server-Side Request Forgery via scrape e -
CVE-2026-12944
Incomplete Security Scanner Blocklist Enables Network-Based -
CVE-2026-12765
Langflow OSS is affected by server-side request forgery due -
CVE-2026-12766
Langflow is vulnerable to Server-Side Request Forgery due to -
CVE-2026-12767
Langflow is vulnerable to server-side request forgery due to
V. Comments for CVE-2026-91750
No comments yet