CVE-2026-91750: Tencent Weknora

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.

Affected products

• Tencent Weknora: from 0.5.2, before 0.7.0 (fixed in 0.7.0)

Published 2026-09-15. Last modified 2026-09-23.