CVE-2026-91750

WeKnora, an open-source RAG knowledge-base platform, in versions before 0.7.0 validates SSRF protections only against the initially supplied URL when ingesting remote documents via the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint, and fails to re-validate the destination of HTTP redirects. An authenticated attacker supplies a public URL that responds with a redirect to an internal address, bypassing the SSRF check and causing the server to fetch internal network resources. Successful exploitation grants the attacker access to internal services and cloud metadata services, which can expose credentials and enable internal network reconnaissance. Any deployment running WeKnora before 0.7.0 where authenticated users can use the URL-import feature is affected; the flaw requires valid credentials but no user interaction. No public proof-of-concept or known in-the-wild exploitation has been reported, and the CVE is not on CISA's KEV list.

What to do: Upgrade to WeKnora 0.7.0 or later, which re-validates redirect targets during document URL ingestion. Until patched, restrict the /api/v1/knowledge-bases/:id/knowledge/url endpoint to trusted users, disable automatic redirect following or block redirects to private and link-local ranges (e.g., RFC 1918, loopback, 169.254.0.0/16), and apply egress allowlisting on the WeKnora host. Review logs for URL imports whose content originated from internal addresses or metadata endpoints such as 169.254.169.254, and rotate any exposed cloud or service credentials.