CVE-2026-30856
Tencent Weknora ≤ 0.3.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-30856 is a medium-severity Use of Incorrectly-Resolved Name or Reference (CWE-706) vulnerability in Tencent Weknora. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-30856 is a vulnerability in WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval, affecting versions prior to 0.3.0. It stems from tool name collision and indirect prompt injection in the MCP client, which uses an ambiguous naming convention of mcp_{service}_{tool}. This allows a malicious remote MCP server to register a tool with the same name as a legitimate one, such as tavily_extract, thereby hijacking tool execution.
An attacker controlling a malicious remote MCP server can exploit this issue, provided they have low privileges (PR:L), the attack requires high complexity (AC:H) and user interaction (UI:R), and is feasible over the network (AV:N). Successful exploitation redirects LLM execution flow, enabling exfiltration of system prompts and context, as well as potential execution of other tools under the user's privileges, resulting in high confidentiality impact (C:H) alongside low integrity (I:L) and availability (A:L) impacts, with a CVSS v3.1 base score of 5.9.
The GitHub security advisory at https://github.com/Tencent/WeKnora/security/advisories/GHSA-67q9-58vj-32qx confirms the issue has been patched in WeKnora version 0.3.0, addressing the naming collision vulnerability (CWE-706).
As an LLM-powered framework, this vulnerability highlights risks in AI/ML tool-calling mechanisms, particularly indirect prompt injection via external service integrations, though no real-world exploitation has been reported.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10179
Vulnerability Data
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an…
more
ambiguous naming convention in the MCP client (mcp_{service}_{tool}), an attacker can register a malicious tool that overwrites a legitimate one (e.g., tavily_extract). This enables the attacker to redirect LLM execution flow, exfiltrate system prompts, context, and potentially execute other tools with the user's privileges. This issue has been patched in version 0.3.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- AI-specific weaknesses CR
- CWE-1427 — Indirect prompt injection via malicious tool collision hijacks LLM tool execution flow.
Mapped by Cyber Resilience · not in NVD. Poisoning and extraction cases are routed to MITRE ATLAS instead of a synthetic CWE.- Classification Reason
- Matched keywords: llm, mcp, prompt injection
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement applies authorization checks to the resolved resource, blocking access outside the intended sphere.
Information flow enforcement can constrain flows that result from an incorrectly resolved name or reference.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly prevent incorrect name/reference resolution bugs during coding.
Enforced authorization boundaries limit damage from an incorrectly resolved reference.
Logical segmentation and access controls reduce the chance an out-of-sphere resolution succeeds.
Hardened configuration baselines can constrain allowable name-to-resource mappings.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect name or reference resolution through fuzzing and negative test cases.
Network segmentation and routing policies reduce the chance that a mis-resolved name leads to an unintended external resource.
Segregated networks limit the blast radius when a name or reference resolves outside the intended control sphere.
Secure SDLC practices include design reviews that can catch incorrect name or reference handling before deployment.
Application security requirements can mandate validation of all external references and names used at runtime.
Secure architecture principles discourage reliance on ambient or globally-resolvable names without explicit scoping.