---
id: "CVE-2026-118376"
kind: "vulnerability"
aliases: ["CVE-2026-118376"]
title: "WeKnora: NAT64 IPv6 addresses bypass internal-address filter, enabling SSRF"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "cloud-metadata", "self-hosted", "weknora"]
not_affected_if: ["already-patched", "auth-required"]
published_at: "2026-10-28T03:17:14+00:00"
first_seen_at: "2026-10-28T03:31:02+00:00"
updated_at: "2026-10-28T03:32:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118376", "first_seen_at": "2026-10-28T03:31:02+00:00"}]
---

# WeKnora: NAT64 IPv6 addresses bypass internal-address filter, enabling SSRF

WeKnora before 0.8.2 fails to recognize NAT64-prefixed IPv6 addresses that point at internal hosts, so its URL fetching treats them as public. An authenticated user can make the server fetch internal services or cloud metadata endpoints through the web_fetch tool or URL-based knowledge import.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the WeKnora version in use; affected builds are those before `0.8.2`.
- Confirm whether web_fetch or URL-based knowledge import is enabled for users.
- unknown whether the sources give a configuration file or endpoint to inspect.

## Fix

- Upgrade WeKnora to `0.8.2` or later.
- Until upgraded, restrict outbound requests from the WeKnora server to internal ranges at the network level, including the NAT64 prefix.

## Timeline

- 2026-10-28T03:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118376

## From the sources

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_