WeKnora CVE-2026-91750

Exploitation requires a valid authenticated session on the WeKnora instance (PR:L - unauthenticated access is insufficient). The attacker must control or have access to a publicly reachable URL that issues an HTTP redirect to an internal target address. The vulnerable path is specifically the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint - only URL-based document ingestion is affected, not file-upload or other ingestion methods. Maximum impact occurs when WeKnora is deployed in a cloud environment with an instance metadata service reachable at link-local addresses (169.254.169.254), or where internal services (Kubernetes API server, internal databases, other microservices) are network-accessible from the WeKnora application host without egress filtering. Versions prior to 0.5.2 are not confirmed affected.

The CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) reasonably reflects the practical exposure: low-complexity network exploitation requiring only a valid session credential, with high confidentiality impact if the attacker can extract cloud IAM credentials or internal service data through the redirect chain. The PR:L constraint is the primary real-world limiter - this is not an unauthenticated issue. The vendor's CVSS 4.0 vector rates subsequent-system impact (SC/SI/SA) all as N, which is technically conservative given that SSRF reaching cloud metadata inherently affects an external system; however, since WeKnora fetches and surfaces the content back to the caller, framing the impact as VC:H on the vulnerable component is defensible. No CISA KEV listing and no public proof-of-concept have been identified, and EPSS data was absent from input, so the actual exploitation probability in the wild cannot be quantified. The redirect-bypass technique is well-understood and requires only an attacker-controlled redirect server, meaning even a mid-sized municipal IT team in gdynia running WeKnora on a cloud-hosted deployment should treat this as a priority patch if the instance is internet-accessible and operates with cloud IAM roles.

An authenticated WeKnora user submits a URL pointing to an attacker-controlled server (e.g., https://attacker.example.com/doc) via the knowledge ingestion endpoint. That server returns an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/, which the Playwright scraper follows without re-validating the redirect destination. The scraper retrieves and stores the cloud instance's IAM credential response, making it accessible to the attacker through the knowledge base content. No public proof-of-concept code has been identified.