CVE-2026-91750 Overview
CVE-2026-91750 is a Server-Side Request Forgery (SSRF) vulnerability in Tencent WeKnora before version 0.7.0. The flaw resides in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint, which downloads documents from user-supplied URLs. While initial SSRF validation blocks direct requests to internal addresses, the application fails to re-validate HTTP redirect targets. Authenticated attackers can bypass the check by supplying a public URL that redirects to internal network resources, cloud metadata services, or private cloud endpoints.
Critical Impact
Authenticated attackers can reach internal services and cloud instance metadata endpoints, potentially exposing credentials and internal infrastructure to unauthorized enumeration.
Affected Products
- Tencent WeKnora versions prior to 0.7.0
- internal/application/service/knowledge_util.go URL import handler
- docreader/parser/web_parser.py document fetcher
Discovery Timeline
- 2026-09-15 - CVE-2026-91750 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91750
Vulnerability Analysis
WeKnora is a Tencent open-source knowledge base platform that ingests documents from user-supplied URLs. The URL import handler performs an initial SSRF safety check against the submitted address, blocking requests aimed at loopback, link-local, and private IP ranges. However, the underlying HTTP client follows redirects without re-applying that validation to intermediate or final Location headers.
An attacker with authenticated access can host an attacker-controlled public URL that returns an HTTP 3xx response redirecting to internal targets. The server follows the redirect and issues a request to the internal address on behalf of the attacker. This exposes cloud instance metadata endpoints such as 169.254.169.254, internal admin panels, and service discovery APIs.
Root Cause
The root cause is a missing re-validation step in the redirect-following logic ([CWE-918]). The initial destination is checked once, but the Go and Python HTTP clients transparently follow redirects to any resolved address without re-invoking is_ssrf_safe_url. This constitutes a Time-of-Check to Time-of-Use (TOCTOU) pattern between validation and network access.
Attack Vector
Exploitation requires an authenticated account with permission to submit knowledge base URLs. The attacker posts a URL pointing to an attacker-controlled HTTP server that responds with a redirect to an internal resource such as http://169.254.169.254/latest/meta-data/. The vulnerable fetcher follows the redirect and returns content or triggers requests against internal endpoints. See the VulnCheck Security Advisory for full details.
# Patch excerpt: docreader/parser/web_parser.py
from docreader.parser.chain_parser import PipelineParser
from docreader.parser.markdown_parser import MarkdownParser
from docreader.utils import endecode
+from docreader.utils.ssrf import is_ssrf_safe_url
logger = logging.getLogger(__name__)
# Source: https://github.com/Tencent/WeKnora/commit/1d322c525a6197d24f07555b4b18ad33313b4328
// Patch excerpt: internal/application/service/knowledge_util.go
"github.com/Tencent/WeKnora/internal/logger"
"github.com/Tencent/WeKnora/internal/types"
"github.com/Tencent/WeKnora/internal/types/interfaces"
+ secutils "github.com/Tencent/WeKnora/internal/utils"
)
// isValidFileType checks if a file type is supported
// Source: https://github.com/Tencent/WeKnora/commit/1d322c525a6197d24f07555b4b18ad33313b4328
The patch introduces a shared is_ssrf_safe_url helper and imports the secutils package so redirect targets are validated on every hop.
Detection Methods for CVE-2026-91750
Indicators of Compromise
- Outbound HTTP requests from WeKnora hosts to link-local addresses such as 169.254.169.254 or private RFC1918 ranges following inbound calls to /api/v1/knowledge-bases/:id/knowledge/url.
- Application logs showing successful URL imports where the requested host resolves to a public address but response content matches cloud metadata schemas.
- Access logs containing HTTP 3xx responses from external hosts immediately preceding internal-network traffic from the WeKnora service account.
Detection Strategies
- Correlate the WeKnora URL import endpoint invocations with the destination IPs contacted by the backend within the same request lifecycle.
- Alert on any egress from the WeKnora application to cloud metadata endpoints, Kubernetes API addresses, or internal service ranges.
- Baseline expected external download targets and flag redirects that terminate at non-public IP space.
Monitoring Recommendations
- Enable verbose HTTP client logging in WeKnora to capture full redirect chains and final resolved hosts.
- Deploy network-layer egress filtering with logging for connections originating from the WeKnora workload.
- Track authentication events tied to knowledge base URL submissions to identify anomalous accounts abusing the import feature.
How to Mitigate CVE-2026-91750
Immediate Actions Required
- Upgrade WeKnora to version 0.7.0 or later, which includes commit 1d322c52 addressing redirect validation.
- Restrict outbound network access from WeKnora hosts to only the domains required for legitimate document ingestion.
- Block the WeKnora workload from reaching cloud metadata endpoints such as 169.254.169.254 at the network or IMDSv2 policy layer.
- Audit existing knowledge base entries for URLs that resolve or redirect to internal ranges.
Patch Information
The fix is delivered in WeKnora 0.7.0 via commit 1d322c52. The patch adds a shared SSRF validation utility that re-checks every URL, including redirect targets, before the HTTP client establishes a connection. Additional context is available in GitHub Issue #2511 and the source at knowledge_util.go.
Workarounds
- Place WeKnora behind an egress proxy that enforces allowlisting of destination hosts and rejects private-range resolutions.
- Enforce IMDSv2 with hop-limit 1 on AWS instances to prevent metadata theft via SSRF.
- Temporarily disable the URL-based knowledge import feature until the upgrade is applied.
- Require additional role-based approval for accounts permitted to submit external URLs.
# Example egress restriction using iptables to block metadata endpoint
iptables -A OUTPUT -m owner --uid-owner weknora -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner weknora -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner weknora -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner weknora -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.