CVE-2026-30856 WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection
Attackers can hijack tool execution in WeKnora via MCP naming collisions, enabling prompt injection, data exfiltration, and unauthorized tool execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-30856?
CVE-2026-30856 is a medium-severity code injection vulnerability in Tencent WeKnora, published on 7 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming convention in the MCP client (mcp_{service}_{tool}), an attacker can register a malicious tool that overwrites a legitimate one (e.g., tavily_extract). This enables the attacker to redirect LLM execution flow, exfiltrate system prompts, context, and potentially execute other tools with the user's privileges. This issue has been patched in version 0.3.0.
Weakness: CWE-706
Which versions are affected by CVE-2026-30856?
3 open source packages ship an affected version, including github.com/Tencent/WeKnora. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/Tencent/WeKnora Go | All versions | None |
github.com/Tencent/WeKnora Go | All versions | 0.3.0 |
github.com/Tencent/WeKnora Go | All versions | 0.3.0 |
Products include Tencent Weknora.
How do I fix CVE-2026-30856?
Upgrade github.com/Tencent/WeKnora to 0.3.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-30856 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30856 exists.
Other vulnerabilities in Tencent WeKnora
- CVE-2026-30860 WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
- CVE-2026-30861 WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
- CVE-2026-22688 WeKnora has Command Injection in MCP stdio test
- CVE-2026-30855 WeKnora: Broken Access Control in Tenant Management
- CVE-2025-11046 Tencent WeKnora test testEmbeddingModel server-side request forgery
Sources
Also known as GHSA-67q9-58vj-32qx, GO-2026-4638.