CVE-2026-30861: Tencent Weknora RCE Vulnerability

CVE-2026-30861 Overview

CVE-2026-30861 is a command injection vulnerability affecting Tencent WeKnora, an LLM-powered framework designed for deep document understanding and semantic retrieval. The vulnerability exists in the MCP (Model Context Protocol) stdio configuration validation component, where insufficient input validation allows attackers to bypass security controls and execute arbitrary commands on the underlying system.

The flaw stems from an incomplete whitelist/blacklist implementation for allowed commands. While the application restricts command execution to npx and uvx commands and implements blacklists for dangerous arguments and environment variables, attackers can bypass these controls using the -p flag with npx node. Combined with unrestricted user registration, any unauthenticated attacker can create an account and exploit this vulnerability to achieve complete system compromise.

Critical Impact

Unauthenticated remote code execution allows complete system compromise through command injection bypass using the -p flag with npx node.

Affected Products

• Tencent WeKnora versions 0.2.5 through 0.2.9
• Systems running WeKnora with MCP stdio configuration enabled
• Deployments with unrestricted user registration

Discovery Timeline

• 2026-03-07 - CVE-2026-30861 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-30861

Vulnerability Analysis

This command injection vulnerability (CWE-78) occurs in the MCP stdio configuration validation within WeKnora. The application implements security controls intended to restrict command execution to a predefined set of safe commands (npx and uvx) while blocking dangerous arguments and environment variables. However, the validation logic contains a critical bypass that allows attackers to execute arbitrary code.

The core issue is that the -p flag in npx allows specifying a package to run, and when combined with node, it effectively enables arbitrary JavaScript execution. Since the security controls focus on blocking specific dangerous patterns rather than implementing a proper allow-list of complete command structures, attackers can craft payloads that pass validation while still achieving code execution.

The attack surface is significantly expanded by the application's unrestricted user registration feature, meaning any anonymous attacker can create an account to exploit this vulnerability without any prior access or credentials.

Root Cause

The root cause of this vulnerability is improper input validation in the command execution pipeline. The security implementation relies on a whitelist for command names and blacklists for dangerous arguments and environment variables. This approach is fundamentally flawed because:

1. The whitelist only validates the primary command (npx, uvx) without considering all possible argument combinations
2. The -p flag bypass was not anticipated in the blacklist implementation
3. The combination of npx -p node followed by arbitrary JavaScript code escapes the intended security boundaries

The validation logic fails to account for the full semantics of the allowed commands, treating them as simple executables rather than complex tools with their own argument parsing.

Attack Vector

The attack is network-accessible and requires low privilege (only user registration). An attacker exploits this vulnerability by:

1. Registering a new account on the WeKnora instance (no approval required)
2. Accessing the MCP stdio configuration interface
3. Crafting a malicious configuration that uses the -p flag bypass
4. Executing arbitrary system commands with the application's privileges

The vulnerability allows complete compromise of the underlying system, including access to sensitive data, modification of system configurations, and potential lateral movement within the network. Since the commands execute with the application's privileges, the impact depends on how WeKnora is deployed and what permissions the service account has been granted.

Detection Methods for CVE-2026-30861

Indicators of Compromise

• Unusual npx process spawns with -p flag arguments containing suspicious code patterns
• Unexpected child processes spawned by the WeKnora application service
• Log entries showing MCP configuration modifications with command injection patterns
• Network connections from the WeKnora process to unexpected external destinations

Detection Strategies

• Monitor process creation events for npx executions with -p node arguments
• Implement application-level logging for MCP configuration changes and command executions
• Deploy endpoint detection rules that alert on shell command patterns originating from the WeKnora service
• Review user registration logs for suspicious account creation patterns followed by configuration changes

Monitoring Recommendations

• Enable verbose logging in WeKnora to capture all MCP configuration submissions
• Configure SIEM rules to correlate user registration events with subsequent command execution anomalies
• Monitor for file system changes in sensitive directories that could indicate post-exploitation activity
• Implement network segmentation monitoring to detect unauthorized outbound connections from WeKnora hosts

How to Mitigate CVE-2026-30861

Immediate Actions Required

• Upgrade Tencent WeKnora to version 0.2.10 or later immediately
• Audit recent user registrations and MCP configurations for signs of exploitation
• Restrict network access to WeKnora instances until patching is complete
• Review system logs for indicators of compromise before and after remediation

Patch Information

Tencent has addressed this vulnerability in WeKnora version 0.2.10. The patch improves the command validation logic to properly handle the -p flag bypass and strengthens the overall input sanitization for MCP stdio configurations. Organizations should upgrade to version 0.2.10 or later as soon as possible.

For detailed patch information and release notes, refer to the GitHub Security Advisory.

Workarounds

• Disable user self-registration and implement manual approval workflows for new accounts
• Implement network-level access controls to restrict who can reach the WeKnora application
• Deploy a web application firewall (WAF) with rules to detect and block command injection patterns
• Run WeKnora in a containerized environment with minimal privileges and restricted system access

# Example: Restrict WeKnora service permissions (Linux)
# Run WeKnora under a dedicated low-privilege user
sudo useradd -r -s /bin/false weknora-service
sudo chown -R weknora-service:weknora-service /opt/weknora
# Limit network access using iptables
sudo iptables -A OUTPUT -m owner --uid-owner weknora-service -j DROP