# CVE-2026-30858: WeKnora SSRF — Fixed in 0.3.0 🐹 🐹 Go Not in CISA KEV MEDIUM severity # CVE-2026-30858 — WeKnora MEDIUM CVE-2026-30858 is a medium-severity (CVSS 6.5) Server-Side Request Forgery (SSRF) vulnerability in github.com/Tencent/WeKnora. A fix is available for github.com/Tencent/WeKnora — see the affected versions and patch details below. WeKnora: DNS Rebinding Vulnerability in web\_fetch Tool Allows SSRF to Internal Resources Also known as[GHSA-h6gw-8f77-mmmp](/vulnerability/GHSA-h6gw-8f77-mmmp)GO-2026-4643 Published Mar 7, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-30858. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.4%probability of exploitation in next 30 days Lower Risk+0.04% Lower risk than most CVEs35th percentile — riskier than 35% of all scored CVEsHighest risk 0.00%0.33%0.65%0.98%0.1%0.4%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐹`github.com/Tencent/WeKnora` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary A DNS rebinding vulnerability in the `web_fetch` tool allows an unauthenticated attacker to bypass URL validation and access internal resources on the server, including private IP addresses (e.g., 127.0.0.1, 192.168.x.x). By crafting a malicious domain that resolves to a public IP during validation and subsequently resolves to a private IP during execution, an attacker can access sensitive local services and potentially exfiltrate data. #### Details The vulnerability exists because the `web_fetch` tool lacks complete DNS pinning. The application performs URL validation only once via `validateParams()`, but the URL is then passed unchanged to the `fetchHTMLContent()` function, which eventually reaches `fetchWithChromedp()`. The headless browser (Chromedp) resolves the hostname independently without DNS pinning, allowing a time-of-check-time-of-use (TOCTOU) attack. **Validation phase (first DNS resolution):** ``` if err := t.validateParams(p); err != nil { // Returns error for private IPs results[index] = &webFetchItemResult{ err: err, // ... } return } ``` **Execution phase (second DNS resolution):** The original URL (not the resolved IP) is passed through the execution chain: ``` output, data, err := t.executeFetch(ctx, p) // Calls fetchHTMLContent(ctx, targetURL) where targetURL is the original hostname ``` **Chromedp execution (vulnerable DNS resolution):** ``` func (t *WebFetchTool) fetchWithChromedp(ctx context.Context, targetURL string) (string, error) { // targetURL is not DNS-pinned; browser resolves it independently err := chromedp.Run(ctx, chromedp.Navigate(targetURL), // Third DNS lookup occurs here chromedp.WaitReady("body", chromedp.ByQuery), chromedp.OuterHTML("html", &html), ) } ``` The attacker controls a domain that can be configured to return different DNS responses to different queries, enabling them to bypass the initial private IP check and access restricted resources during the actual fetch. #### PoC **Setup:** 1. Deploy the DNS rebinding server (attached Python file) with the following systemd configuration: ``` [Unit] Description=DNS Rebinding Test Server After=network.target [Service] Type=simple User=root WorkingDirectory=/root/Repos/dns-rebinding-server ExecStart=/root/.proto/shims/python -u /root/Repos/dns-rebinding-server/server.py --token aleister1102 --domain aleister.ninja --port 53 --global-tracking --ip1 1.1.1.1 --ip2 0.0.0.0 --first-response-count 1 --reset-time 0 Restart=always RestartSec=3 [Install] WantedBy=multi-user.target ``` This configures the DNS server to: - Return `1.1.1.1` (a public IP) for the first DNS query - Return `127.0.0.1` (localhost) for all subsequent queries - TTL is set to 0 to prevent caching The sequence can also be reset via reset.domain.com (reset to 1.1.1.1). > Note: We may need to reset the sequence as the TOCTOU attack is not truly reliable and needs to be triggered multiple times. 1. Set up a simple HTTP server on the localhost of the backend service: ``` python -m http.server 8888 ``` 1. Configure the malicious domain to point to the DNS rebinding server **Execution:** 1. Enable web search on an agent. 2. Prompt the agent to fetch content from the attacker-controlled domain (e.g., `http://attacker.example.com`) 3. The sequence of events: - **First DNS query** (validation phase): `attacker.example.com` → `1.1.1.1` ✓ Passes validation - **Second DNS query** (execution phase): `attacker.example.com` → `127.0.0.1` ✗ Bypass achieved - The `web_fetch` tool successfully connects to `127.0.0.1:8080` and returns the local server's content **Result:** The attacker gains access to the local HTTP server and can read its content, demonstrating that internal resources are now accessible through the rebinding attack. image PoC video: [https://github.com/user-attachments/assets/68daaa87-4b9b-4b6e-b6f6-ee123f5fcda9](https://github.com/user-attachments/assets/68daaa87-4b9b-4b6e-b6f6-ee123f5fcda9) #### Impact **Vulnerability Type:** DNS Rebinding / Server-Side Request Forgery (SSRF) **Who is impacted:** - Any user or agent with web search capability can exploit this vulnerability - The vulnerability grants access to internal services, configuration files, metadata services, and other sensitive resources normally restricted to the internal network - In cloud environments, this could allow access to metadata endpoints (e.g., AWS IMDSv1) to obtain credentials and secrets\\ ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐹Go `github.com/Tencent/WeKnora` all versions 0.3.0`go get github.com/Tencent/WeKnora@v0.3.0` ## Affected Products 1 product · 1 configurations Application `weknora`tencent < 0.3.0 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/Tencent/WeKnora, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update github.com/Tencent/WeKnora to 0.3.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-30858 is resolved across your whole dependency graph. 3. ### Workarounds Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated. ## Frequently Asked Questions \### Summary A DNS rebinding vulnerability in the \`web\_fetch\` tool allows an unauthenticated attacker to bypass URL validation and access internal resources on the server, including private IP addresses (e.g., 127.0.0.1, 192.168.x.x). By crafting a malicious domain that resolves to a public IP during validation and subsequently resolves to a private IP during execution, an attacker can access sensitive local services and potentially exfiltrate data. ### Details The vulnerability exists because the \`web\_fetch\` tool lacks complete DNS pinning. The application performs URL validation only once O3 Security · Impact-Aware SCA ### Is CVE-2026-30858 in your dependencies? Find it across Go, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)