CVE-2026-91750: WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
WeKnora deployments running a version before 0.7.0 are affected where authenticated users can use the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint to download a document from a supplied URL.
What does an attacker need to exploit this issue?
An attacker needs valid authentication and the ability to submit a URL to the affected knowledge-base URL import endpoint. They can provide a public URL that redirects to an internal address after passing the initial validation.
What could an attacker access through exploitation?
The issue can allow access to internal network services and cloud metadata endpoints. The reported impact is exposure of confidential information; integrity and availability impacts are not indicated.