CVE-2026-118376: WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses

Q: Which deployments are exposed?

WeKnora versions before 0.8.2 are affected where authenticated users can use web_fetch or URL-based knowledge import. The issue can allow requests to internal services or cloud metadata endpoints through NAT64-encoded internal addresses.

Q: What does an attacker need to exploit this?

The attacker needs an authenticated WeKnora account and must be able to provide a URL through web_fetch or URL-based knowledge import. Exploitation relies on supplying a URL that resolves to a NAT64-prefixed IPv6 encoding of an internal address.

Q: What is the recommended remediation?

Upgrade WeKnora to version 0.8.2 or later. The affected behavior is the isRestrictedIP() handling of NAT64-prefixed IPv6 addresses.

Published Oct 28, 2026

Updated

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via webfetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.

Affected Software

1 affected component

WeKnora WeKnora<0.8.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WeKnora to a version that resolves this vulnerability.
Fixed in 0.8.2

Event History

Oct 28, 2026

CVE Published

via MITRE·02:03 AM

Data Sourced

via MITRE·02:03 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

WeKnora versions before 0.8.2 are affected where authenticated users can use web_fetch or URL-based knowledge import. The issue can allow requests to internal services or cloud metadata endpoints through NAT64-encoded internal addresses.

What does an attacker need to exploit this?