CVE-2026-30247: Tencent Weknora SSRF Vulnerability

CVE-2026-30247 Overview

CVE-2026-30247 is a Server-Side Request Forgery (SSRF) vulnerability in Tencent WeKnora, an LLM-powered framework designed for deep document understanding and semantic retrieval. The vulnerability exists in the application's "Import document via URL" feature, which fails to validate redirect targets despite implementing comprehensive initial URL validation. This bypass allows attackers to force the server to access internal services, potentially exposing sensitive internal resources and cloud metadata.

Critical Impact

Attackers can bypass URL validation protections using HTTP redirect chains to access internal services, Docker-specific addresses like host.docker.internal, and potentially cloud metadata endpoints, leading to significant information disclosure.

Affected Products

• Tencent WeKnora versions prior to 0.2.12

Discovery Timeline

• 2026-03-07 - CVE-2026-30247 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30247

Vulnerability Analysis

This vulnerability represents a classic SSRF bypass technique where the application's security controls are circumvented through HTTP redirects. While the WeKnora backend implements comprehensive URL validation at the initial request stage—blocking private IP ranges, loopback addresses (127.0.0.1, localhost), reserved hostnames, and cloud metadata endpoints—it fails to apply these same validations when following HTTP redirects (3xx responses).

The flaw enables an attacker to submit a seemingly benign external URL that redirects to restricted internal resources. This is particularly concerning in containerized environments where Docker-specific internal addresses like host.docker.internal are not blocked, potentially allowing access to the host machine's services from within a container.

Root Cause

The root cause is an incomplete implementation of URL validation in the HTTP client handling the document import functionality. The validation logic only inspects the initial URL provided by the user but does not re-validate URLs encountered during HTTP redirect processing. This creates a time-of-check to time-of-use (TOCTOU) gap where the security check occurs on a different URL than the one ultimately accessed.

Additionally, the blocklist does not account for Docker-specific networking features such as host.docker.internal, which resolves to the Docker host in common container runtimes.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Setting up an external web server that responds with an HTTP redirect (301/302) to an internal target
2. Submitting the attacker-controlled URL to the WeKnora "Import document via URL" feature
3. The server validates the initial external URL (which passes all checks)
4. The server follows the redirect to the attacker-specified internal resource
5. The server accesses internal services, cloud metadata endpoints, or Docker host services

For example, an attacker could redirect to http://169.254.169.254/latest/meta-data/ in AWS environments to retrieve instance metadata and potentially IAM credentials, or to http://host.docker.internal:8080/ to access services running on the Docker host.

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-30247

Indicators of Compromise

• Unusual outbound requests from the WeKnora application to internal IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
• Access logs showing requests to cloud metadata endpoints (169.254.169.254)
• HTTP requests to host.docker.internal or similar Docker-specific hostnames
• Multiple redirect chains in application logs originating from document import operations

Detection Strategies

• Monitor application logs for document import requests that result in connections to internal IP addresses
• Implement network-level monitoring to detect outbound connections from the WeKnora service to private IP ranges
• Alert on any HTTP requests to cloud provider metadata endpoints from application servers
• Review web server logs for redirect responses followed by requests to internal resources

Monitoring Recommendations

• Deploy network segmentation and monitor east-west traffic from containers running WeKnora
• Configure WAF rules to detect and block SSRF patterns in URL parameters
• Enable verbose logging for the document import functionality to track redirect chains
• Set up alerts for connections to Docker-specific hostnames from production environments

How to Mitigate CVE-2026-30247

Immediate Actions Required

• Upgrade Tencent WeKnora to version 0.2.12 or later immediately
• Review application logs for any suspicious document import activity that may indicate exploitation
• Implement network-level restrictions to prevent the WeKnora service from accessing internal networks
• Consider temporarily disabling the "Import document via URL" feature until patching is complete

Patch Information

This vulnerability has been addressed in WeKnora version 0.2.12. The patch implements redirect target validation to ensure all URLs in a redirect chain are validated against the same security controls as the initial request. Organizations should update to this version or later to remediate the vulnerability.

For more details, see the GitHub Security Advisory.

Workarounds

• Disable HTTP redirect following in the application configuration if the feature supports it
• Implement network-level firewall rules to block the WeKnora service from accessing internal IP ranges
• Deploy a forward proxy that validates all outbound requests against an allowlist of permitted domains
• Use network segmentation to isolate the WeKnora service from internal resources and cloud metadata services

# Example: Block internal network access using iptables
# Apply to the server running WeKnora

# Block access to private IP ranges
iptables -A OUTPUT -m owner --uid-owner weknora -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner weknora -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner weknora -d 192.168.0.0/16 -j DROP

# Block cloud metadata endpoints
iptables -A OUTPUT -m owner --uid-owner weknora -d 169.254.169.254 -j DROP

# Block localhost/loopback
iptables -A OUTPUT -m owner --uid-owner weknora -d 127.0.0.0/8 -j DROP