CVE-2026-118376
Deferred Deferred - Pending Action

WeKnora SSRF via NAT64 IP Misclassification Before 0.8.2

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-118376
EUVD
EUVD-2026-111552

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Tencent WeKnora 0.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in WeKnora versions before 0.8.2. The isRestrictedIP() function incorrectly classifies NAT64-prefixed IPv6 addresses as public, allowing attackers to bypass IP restrictions. By supplying URLs that resolve to NAT64-encoded internal addresses, authenticated users can access internal services or cloud metadata endpoints through features like web_fetch or URL-based knowledge import.

Detection Guidance

To detect this SSRF vulnerability in WeKnora, check if your system is running versions before 0.8.2. Review network logs for outbound requests to NAT64-prefixed IPv6 addresses (e.g., 64:ff9b::/96) or internal cloud metadata endpoints (e.g., 169.254.169.254). Use tools like curl or wget to test if the isRestrictedIP() function incorrectly allows such requests.

Impact Analysis

An attacker could exploit this to access internal services or cloud metadata endpoints, potentially exposing sensitive data like IAM credentials. This is especially risky in dual-stack or NAT64-enabled deployments where restricted IPv4 addresses are encoded into IPv6 using NAT64 prefixes.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR (e.g., unauthorized data access) and HIPAA (e.g., exposure of PHI). Compliance may be impacted if sensitive data is exposed due to insufficient SSRF protections.

Mitigation Strategies

Upgrade WeKnora to version 0.8.2 or later immediately. If upgrading is not possible, restrict access to the isRestrictedIP() function or block NAT64-prefixed IPv6 addresses at the network level. Monitor for unusual outbound requests to internal services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart