WeKnoraのweb_fetchツールにDNSリバインディングの脆弱性が存在し、github.com/Tencent/WeKnora内の内部リソースへのSSRFを許可する

The SSRF vulnerability in WeKnora allows an attacker to craft malicious requests that appear to originate from the WeKnora server itself. By exploiting DNS rebinding, an attacker can manipulate the domain name resolution to point to internal resources that are otherwise inaccessible from the outside. This could lead to unauthorized access to sensitive data, internal APIs, or even the ability to interact with internal services. The impact is amplified if WeKnora is deployed in an environment with sensitive internal resources, such as databases or configuration management systems. Successful exploitation could result in data breaches, privilege escalation, and disruption of internal services.

Organizations deploying WeKnora in environments with internal resources accessible via HTTP or HTTPS are at risk. This includes deployments behind firewalls or in segmented networks where internal services are exposed. Shared hosting environments utilizing WeKnora are also particularly vulnerable due to the potential for cross-tenant exploitation.

• go / server:

ps aux | grep WeKnora

• go / server:

journalctl -u weknora | grep -i 'web_fetch'

• generic web:

curl -I <weknora_server_ip>/web_fetch?url=http://evil.com  # Check for internal resource exposure in response headers

1. 2026-03-10Disclosure

   disclosure

1. 予約済み2026-03-05
2. 公開日2026-03-10
3. 更新日2026-03-23
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-30858 is to upgrade WeKnora to version 0.3.0 or later, which includes the fix for the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound network access from the WeKnora server to only necessary domains. Implement strict input validation on the web_fetch tool to prevent malicious URL manipulation. Consider deploying a Web Application Firewall (WAF) with rules to detect and block SSRF attempts based on suspicious URL patterns and DNS resolution anomalies. Monitor network traffic for unusual outbound requests originating from the WeKnora server.