{"id":"CVE-2026-118376","kind":"vulnerability","aliases":["CVE-2026-118376"],"related":[],"title":"WeKnora: NAT64 IPv6 addresses bypass internal-address filter, enabling SSRF","description":"WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.","summary":"WeKnora before 0.8.2 fails to recognize NAT64-prefixed IPv6 addresses that point at internal hosts, so its URL fetching treats them as public. An authenticated user can make the server fetch internal services or cloud metadata endpoints through the web_fetch tool or URL-based knowledge import.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","cloud-metadata","self-hosted","weknora"],"not_affected_if":["already-patched","auth-required"],"how_to_check":"- Check the WeKnora version in use; affected builds are those before `0.8.2`.\n- Confirm whether web_fetch or URL-based knowledge import is enabled for users.\n- unknown whether the sources give a configuration file or endpoint to inspect.","fix":"- Upgrade WeKnora to `0.8.2` or later.\n- Until upgraded, restrict outbound requests from the WeKnora server to internal ranges at the network level, including the NAT64 prefix.","status":"open","published_at":"2026-10-28T03:17:14+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:47+00:00","updated_at":"2026-10-28T03:32:47+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-28T03:32:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade WeKnora to `0.8.2` or later.\n- Until upgraded, restrict outbound requests from the WeKnora server to internal ranges at the network level, including the NAT64 prefix.","reach":"internet","title":"WeKnora: NAT64 IPv6 addresses bypass internal-address filter, enabling SSRF","impact":"medium","summary":"WeKnora before 0.8.2 fails to recognize NAT64-prefixed IPv6 addresses that point at internal hosts, so its URL fetching treats them as public. An authenticated user can make the server fetch internal services or cloud metadata endpoints through the web_fetch tool or URL-based knowledge import.","category":"ai-tooling","nicknames":[],"who_cares":["self-hosted","weknora","cloud-metadata"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads internal services and cloud metadata credentials via server requests","analyst_note":"","how_to_check":"- Check the WeKnora version in use; affected builds are those before `0.8.2`.\n- Confirm whether web_fetch or URL-based knowledge import is enabled for users.\n- unknown whether the sources give a configuration file or endpoint to inspect.","needs_analyst":false,"not_affected_if":["auth-required","already-patched"],"who_is_affected":"Teams that self-host WeKnora below `0.8.2` and let users add URLs through web_fetch or URL-based knowledge import are exposed. Instances where only trusted administrators can submit URLs, or where the host has no reachable internal services or cloud metadata, carry less risk. Deployments that already run `0.8.2` or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000647,"input_tokens":3355,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118376':14A,17A '-2026':13A,16A '0.8.2':30B,79C 'address':4A,8A,38B,96C,110C 'ai':19B 'ai-tool':18B 'attack':100C 'authent':53B,99C 'base':74B,117C 'bypass':5A 'cloud':22B,63B,125C 'cloud-metadata':21B 'contain':80C 'cve':12A,15A 'enabl':10A 'encod':107C 'endpoint':65B,127C 'fail':31B 'fetch':47B,59B,69B,113C 'filter':9A 'forgeri':86C 'host':26B,43B 'import':76B,119C 'intern':7A,42B,60B,109C,122C 'internal-address':6A 'ipv6':3A,37B,95C 'isrestrictedip':89C 'knowledg':75B,118C 'make':56B 'metadata':23B,64B,126C 'misclassifi':91C 'nat64':2A,35B,93C,106C 'nat64-prefixed':34B,92C 'point':40B 'prefix':36B,94C 'public':51B,98C 'reach':121C 'recogn':33B 'request':85C 'resolv':104C 'self':25B 'self-host':24B 'server':58B,83C 'server-sid':82C 'servic':61B,123C 'side':84C 'ssrf':11A 'suppli':102C 'tool':20B,70B 'treat':48B 'url':46B,73B,103C,116C 'url-bas':72B,115C 'user':54B 'via':111C 'vulner':87C 'web':68B,112C 'weknora':1A,27B,28B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host WeKnora below `0.8.2` and let users add URLs through web_fetch or URL-based knowledge import are exposed. Instances where only trusted administrators can submit URLs, or where the host has no reachable internal services or cloud metadata, carry less risk. Deployments that already run `0.8.2` or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118376","severity":null,"published_at":"2026-10-28T03:17:14+00:00","modified_at":"2026-10-28T03:17:14+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}