The vulnerability is a DNS rebinding flaw in the web_fetch component of WeKnora that lets an unauthenticated attacker bypass URL validation. By submitting a domain that maps to a public IP during validation and to a private IP during execution, the attacker can activate server‑side request forgery and retrieve data from internal services such as 127.0.0.1 or 192.168.x.x. This breach can expose sensitive information and compromise the confidentiality of the internal network. The weakness maps to CWE‑918, reflecting a failure to validate or restrict network requests.

Tencent’s WeKnora framework, all releases before version 0.3.0, employs this web_fetch tool without a protective check. The flaw affects any installation of WeKnora where the tool is enabled, regardless of the host platform, because DNS rebinding can be triggered by an external party with nothing more than a crafted domain.

The CVSS base score of 6.5 indicates a moderate severity that could lead to data exposure. The EPSS value of less than 1 % suggests that, as of now, the probability of mass exploitation is low, and the vulnerability is not recorded in the CISA KEV list. Nonetheless, the attack requires only creation of a malicious domain and no additional privileged access, making it accessible to a broad threat set. If compromised, an attacker could pivot to internal services or extract data, so the risk remains significant for environments that expose WeKnora to the internet.