CVE-2026-108821

Executive Summary

CVE-2026-108821 is a SQL injection vulnerability in Tencent WeKnora, an open-source retrieval-augmented generation (RAG) and knowledge-base platform, affecting versions up to and including 0.8.1. The flaw resides in the validateSubquery function within internal/utils/inject.go, part of the application's SQL Validator component, and can be triggered remotely by an authenticated attacker. Successful exploitation enables unauthorized data access and modification (CVSS 6.3; C:L/I:L/A:L), and a public exploit has been disclosed, raising the urgency for defenders running affected deployments.

Technical Analysis

The vulnerability class is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., injection), specifically manifesting as SQL injection (CWE-89-style semantics) inside a SQL validation routine. WeKnora exposes a component referred to as the "SQL Validator," located in internal/utils/inject.go. This file name strongly suggests the validator is intended to inspect SQL statements — likely those produced by an LLM or natural-language query interface — to reject dangerous constructs before execution against the backend database.

The impacted function is validateSubquery. Its name indicates responsibility for validating nested/subquery SQL before it is passed downstream for execution. The vulnerability arises because the manipulation of inputs to this function leads to SQL injection: the validator's logic can be bypassed or, more critically, the act of validation itself does not neutralize the injected SQL that downstream processing will execute. In either case, an attacker who can influence the SQL statement processed by the validator can smuggle executable SQL past the intended filtering layer.

The attack surface is remote (CVSS vector AV:N). The privilege requirement is low (PR:L), meaning the attacker needs some authenticated or otherwise minimal-privilege foothold in the application — consistent with a registered user who can issue queries through the knowledge-base or query interface. Complexity is low (AC:L), no user interaction is required (UI:N), and scope is unchanged (S:U), so the impact is confined to the vulnerable component and its data stores. Confidentiality, integrity, and availability are all rated Low (C:L/I:L/A:L), indicating partial data exposure and modification without demonstrated full-system compromise. The overall base score is 6.3 (Medium).

The vendor addressed the issue in version 0.8.2, with a patch identified by commit d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. No code snippet from the advisory is available, so the precise sanitization fix cannot be described beyond observing that the validator's handling of subquery input was corrected. Note that no patch evidence is currently confirmed in tracked sources (patch confidence 0/4); defenders should verify the 0.8.2 release artifacts and the referenced commit directly rather than relying on this report alone.

Exploitation Scenarios

No public exploit code or Nuclei template is bundled in this intelligence dataset, but the NVD description states the exploit has been disclosed publicly and may be used. The following chain is described at the vulnerability-class level; no implementation specifics beyond the named function and file are supplied, and none should be assumed.

1. Reconnaissance / target identification. An attacker identifies a reachable WeKnora deployment (version <= 0.8.1) exposed to users, for example an internal or internet-facing knowledge-base instance. Because exploitation requires low privilege (PR:L), the attacker expects to need at least a basic account or an unauthenticated-but-limited entry point that reaches the query interface. Fingerprinting can leverage the WeKnora product name and interface in HTTP responses.

2. Triggering the flaw. The attacker supplies input that reaches the SQL Validator's validateSubquery logic — that is, a query or query fragment containing a subquery that the validator processes. Where natural-language or user-modifiable queries are translated into SQL, the attacker crafts the query content so that the SQL passed to and subsequently executed after validation contains attacker-controlled SQL. The vulnerability lies in the fact that this input is not properly neutralized, allowing the injection to survive validation.

3. Payload / execution. At the vulnerability-class level, the payload is malicious SQL embedded within a subquery context. The objective is to escape the intended subquery boundary so that the statement executed by the backend database includes attacker-chosen SQL. Because the validator is named for "subquery" handling, the injection point is most plausibly a nested query that the validator fails to sanitize or mis-parses. (No specific tautology, UNION, or stacked-query pattern can be asserted from the available data.)

4. Post-exploitation impact. Consistent with C:L/I:L/A:L, the attacker can read and modify data in the underlying database with partial scope — for example, accessing knowledge-base documents or metadata beyond their authorization, or altering stored content. Because scope is unchanged (S:U), there is no demonstrated pivot to full host takeover from this CVE alone. Availability impact is low, so denial-of-service via database manipulation is possible but not severe in the advisory's assessment.

Impact Assessment

The affected product is Tencent WeKnora, an AI/RAG-adjacent data platform where the database typically holds indexed knowledge, embeddings, and related organizational content. A SQL injection here matters disproportionately because the target store frequently contains sensitive internal documents and intellectual property. CVSS 6.3 (Medium) reflects a remote, low-complexity attack requiring only low privileges, with limited but real confidentiality, integrity, and availability impact. The blast radius is bounded by the application's database permissions: an affected instance could expose or tamper with the data the WeKnora service account can reach, but not, per the CVSS scope, unrelated systems. Public exploit availability increases the likelihood of opportunistic scanning and targeted attempts against unpatched internet-facing or internally reachable deployments. CISA KEV status is "NO," and EPSS has not yet been scored, so there is no independent evidence of mass exploitation at time of writing.

Detection Guidance

Detection should focus on anomalous SQL constructs arriving at WeKnora's query interface and on database-side errors or unexpected statement patterns. Because the validator is an application-layer gate, both application logs (query text, validation failures, errors) and backend database audit logs are valuable telemetry sources.

Sigma Rule

title: Tencent WeKnora SQL Validator Injection Attempt (CVE-2026-108821)
id: 8f3c2b41-9a7d-4e21-b6c0-weknora108821
status: experimental
description: Detects SQL injection patterns directed at WeKnora query interfaces that may indicate exploitation of validateSubquery in internal/utils/inject.go.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108821
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'subquery'
      - 'query='
      - 'sql='
  selection_keywords:
    cs-uri-query|contains:
      - 'UNION SELECT'
      - 'OR 1=1'
      - 'SLEEP('
      - 'BENCHMARK('
      - 'information_schema'
      - '/*'
  condition: selection_uri and selection_keywords
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
falsepositives:
  - Legitimate administrative query tooling
level: high

YARA Rule

rule CVE_2026_108821_WeKnora_SQLi
{
    meta:
        description = "Detects SQL injection indicators targeting Tencent WeKnora SQL Validator (CVE-2026-108821)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108821"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "information_schema" nocase
        $sqli4 = "validateSubquery" nocase
        $filepath = "internal/utils/inject.go" nocase
        $sleep = "SLEEP(" nocase

    condition:
        (2 of ($sqli1, $sqli2, $sqli3, $sleep)) or $filepath
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108821 Tencent WeKnora SQL Injection Attempt"; flow:to_server,established; http.uri; content:"query"; nocase; http.uri; content:"UNION"; nocase; http.uri; content:"SELECT"; nocase; distance:0; reference:cve,2026-108821; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108821; classtype:web-application-attack; sid:2026108821; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and http.request.method in ("GET","POST") and
     url.query : ("*subquery*" or "*query=*")]
  [network where url.query : ("*UNION SELECT*" or "*OR 1=1*" or "*information_schema*" or "*SLEEP(*")]

Splunk SPL Query

index=web OR index=weknora
| eval q=lower(coalesce(uri_query, cs_uri_query, url, ""))
| where match(q, "(union\s+select|or\s+1=1|information_schema|sleep\(|benchmark\()")
| stats count min(_time) as first_seen max(_time) as last_seen values(q) as payloads by src_ip, uri_path
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="weknora,web,">
  <rule id="100821" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>query</url>
    <regex offset="after_parent">(?i)(union\s+select|or\s+1=1|information_schema|sleep\()</regex>
    <description>CVE-2026-108821: Possible Tencent WeKnora SQL injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory recommends upgrading to version 0.8.2 and cites patch commit d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda; because no tracked source currently confirms patch coverage, verify these artifacts before relying on them.

1. Immediate mitigations. Do not expose WeKnora query interfaces to untrusted users or the internet. Enforce strong authentication and least privilege so that reaching the SQL Validator requires a real, identifiable account (exploitation needs PR:L). Restrict the database account used by WeKnora to the minimum required permissions, removing DDL and unnecessary write grants to blunt integrity impact. Deploy WAF/IDS rules such as those above to flag subquery and SQLi patterns in real time, and monitor database audit logs for unexpected statement shapes or error spikes.

2. Patch/upgrade steps. Upgrade affected instances (<= 0.8.1) to version 0.8.2 per the advisory, and independently confirm the fix by reviewing commit d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. Validate that the deployed build hash matches the intended 0.8.2 release. If immediate upgrade is not possible, isolate the instance and treat it as untrusted pending remediation.

3. Long-term hardening. Adopt parameterized queries and strict allow-listing in any SQL-construction path rather than relying on a validation/subquery-inspection layer alone. Add automated regression tests for SQL injection (including subquery payloads) to CI, require security review for changes to internal/utils/inject.go and the SQL Validator, and maintain an SBOM/version inventory to rapidly identify vulnerable WeKnora deployments. Track the vendor and NVD advisory for escalation to KEV or EPSS scoring.

References

• NVD — CVE-2026-108821: https://nvd.nist.gov/vuln/detail/CVE-2026-108821
• Tencent WeKnora project / release notes for version 0.8.2 (vendor advisory); patch commit d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: https://cwe.mitre.org/data/definitions/74.html
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-108821 not listed as of this report)

Exploit-in-the-wild and threat-actor campaign data: none available. The NVD description states a public exploit has been disclosed and may be used; no adversary campaign attribution is provided in the source data.