Plango
Get Plango

For developers

Mac security

← AI agent vulnerabilities

CVE-2026-30856

WeKnora

5.9
Severity
Medium
Published
March 7, 2026
Last modified
June 17, 2026

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming convention in the MCP client (mcp_{service}_{tool}), an attacker can register a malicious tool that overwrites a legitimate one (e.g., tavily_extract). This enables the attacker to redirect LLM execution flow, exfiltrate system prompts, context, and potentially execute other tools with the user's privileges. This issue has been patched in version 0.3.0.

CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

Weakness

References

CVE-2026-30856 on NVD

Listed in

MediumMCP servers

More WeKnora CVEs

Jan 10
CVE-2026-226889.9

There is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values.