What is the CVSS score of CVE-2026-30860?

CVE-2026-30860 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PostgreSQL are affected by CVE-2026-30860?

A critical remote code execution vulnerability (CVE-2026-30860) affects WeKnora LLM framework versions prior to 0.2.12, allowing unauthenticated attackers to execute arbitrary code through database…. A patch is available.

Is there a public PoC exploit available for CVE-2026-30860?

Yes, a public proof-of-concept exploit is available for CVE-2026-30860. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-30860?

Within 24 hours: Inventory all systems running WeKnora and identify version numbers; isolate affected instances from production networks or restrict access to trusted IPs only. Within 7 days: Contact WeKnora vendor for patch availability timeline and interim security guidance; implement network segmentation to limit lateral movement from compromised systems. Within 30 days: Deploy patched version immediately upon release; conduct forensic analysis for evidence of exploitation; review and strengthen access controls and monitoring for database query anomalies.

PostgreSQL CVE-2026-30860

CRITICAL

SQL Injection (CWE-89)

2026-03-07 security-advisories@github.com

GHSA-8w32-6mrw-q5wv

RCE SQLi PostgreSQL AI / ML Weknora Suse Tencent

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 17:35 vuln.today

Public exploit code

CVE Published

Mar 07, 2026 - 17:15 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By smuggling dangerous PostgreSQL functions inside these expressions and chaining them with large object operations and library loading capabilities, an unauthenticated attacker can achieve arbitrary code execution on the database server with database user privileges. This issue has been patched in version 0.2.12.

AnalysisAI

SQL injection in WeKnora LLM document understanding framework allows authenticated users to extract arbitrary database contents. CVSS 9.9 with scope change. PoC available.