CVE-2026-8786: falha de média gravidade em Tencent WeKnora
Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.3%
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Tencent · WeKnoraPoCs públicas encontradas — 1
cve_referencegist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7bnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Tencent WeKnora
No mesmo produto, das mais perigosas para as menos.
CVE-2026-30861CRITICALWeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration ValidationEPSS 2.4%CVE-2026-22688CRITICALWeKnora has Command Injection in MCP stdio testEPSS 1.9%CVE-2026-30860CRITICALWeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query ToolEPSS 0.7%CVE-2025-11046MEDIUMTencent WeKnora test testEmbeddingModel server-side request forgeryEPSS 0.5%CVE-2026-91750HIGHWeKnora before 0.7.0 SSRF via Unvalidated HTTP RedirectsEPSS 0.4%CVE-2026-30247MEDIUMWeKnora: SSRF via RedirectionEPSS 0.4%