CVE-2026-30859

Executive Summary

CVE-2026-30859 is a critical broken access control vulnerability in WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval. The vulnerability allows any authenticated tenant to read sensitive data belonging to other tenants, including API keys, model configurations, and private messages. The root cause is the failure to enforce tenant isolation on critical database tables (models, messages, embeddings). This issue has been patched in version 0.2.12.

Supply Chain & Package Security

WeKnora is a Python-based framework distributed via PyPI. The vulnerability affects all versions prior to 0.2.12. Organizations using WeKnora should immediately upgrade to version 0.2.12 or later. The package is not known to be affected by any other supply chain issues at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is 5.3, the potential for data exfiltration of sensitive tenant data (API keys, model configs, private messages) elevates the real-world risk significantly.

Deep Dive & Mechanics

The vulnerability resides in the database query tool of WeKnora. The application uses a multi-tenant architecture where each tenant's data should be isolated. However, the database query tool fails to enforce tenant-level access controls on critical tables:

• models: Contains model configurations, including API keys and endpoints.
• messages: Contains private messages between users.
• embeddings: Contains vector embeddings of documents.

An authenticated user from Tenant A can craft a database query that retrieves data from Tenant B's records. This is possible because the query tool does not append a WHERE tenant_id = ? clause to the SQL queries, or the tenant context is not properly validated before executing the query.

The vulnerability is exploitable with only user-level authentication privileges, meaning any authenticated user (not just admins) can perform the attack.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-0.2.12):

# In the database query tool, the tenant context is not enforced
def execute_query(query_string):
    # Directly executes the query without tenant isolation
    result = db.execute(query_string)
    return result

Patched Code (0.2.12):

# In the patched version, tenant isolation is enforced
def execute_query(query_string, tenant_id):
    # Validate that the query only accesses data for the current tenant
    if not is_tenant_allowed(query_string, tenant_id):
        raise PermissionError("Cross-tenant access denied")
    # Append tenant filter to the query
    safe_query = add_tenant_filter(query_string, tenant_id)
    result = db.execute(safe_query)
    return result

The patch introduces a tenant validation layer that ensures queries are scoped to the authenticated user's tenant.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a WeKnora instance (version < 0.2.12)
• Valid user credentials for any tenant

Exploitation Steps:

1. Authenticate to the WeKnora instance using valid credentials.
2. Navigate to the database query tool (typically at /api/query or /admin/query).
3. Craft a malicious query to extract data from another tenant. For example:

   SELECT * FROM models WHERE tenant_id != 'your_tenant_id'
   

   Or, if the tenant ID is not exposed:

   SELECT * FROM models LIMIT 100
   

4. Execute the query and observe the response containing sensitive data from other tenants.

Example using curl:

curl -X POST https://target-weknora.com/api/query \
  -H "Authorization: Bearer <your_token>" \
  -H "Content-Type: application/json" \
  -d '{"query": "SELECT * FROM models"}'

Blue Team

Detection Steps:

1. Monitor database query logs for unusual patterns, especially queries that do not include a tenant filter.
2. Audit access logs for repeated queries to the /api/query endpoint from a single user.
3. Review database access patterns for cross-tenant data retrieval.

Hunting Query (SQL):

SELECT * FROM query_logs
WHERE query_text NOT LIKE '%tenant_id%'
AND query_text LIKE '%SELECT%'
AND timestamp > NOW() - INTERVAL 7 DAY;

Indicators of Compromise (IOCs)

• Network: Unusual database query requests to /api/query or /admin/query endpoints.
• Logs: Database query logs showing queries without tenant filters.
• Data: Exfiltration of API keys, model configurations, or private messages from multiple tenants.
• File: Unexpected database dumps or exports.

Detection Engineering

YARA Rule

rule Detect_WeKnora_CrossTenant_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2026-30859 in WeKnora"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-30859"
    strings:
        $s1 = "SELECT * FROM models" ascii nocase
        $s2 = "SELECT * FROM messages" ascii nocase
        $s3 = "SELECT * FROM embeddings" ascii nocase
        $s4 = "/api/query" ascii nocase
        $s5 = "/admin/query" ascii nocase
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: WeKnora Cross-Tenant Data Access Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-30859 by querying cross-tenant data
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: weknora
detection:
    selection:
        http.method: POST
        http.url: 
            - "/api/query"
            - "/admin/query"
        http.body: 
            - "SELECT * FROM models"
            - "SELECT * FROM messages"
            - "SELECT * FROM embeddings"
    condition: selection
falsepositives:
    - Legitimate database administration activities
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"WeKnora Cross-Tenant Data Access Attempt (CVE-2026-30859)";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/query"; http_uri;
    content:"SELECT * FROM models"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-30859;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WeKnora to version 0.2.12 or later.
2. Restrict access to the database query tool to only authorized administrators.
3. Audit all existing database queries for potential cross-tenant access.

Long-term Mitigations:

1. Implement network segmentation to isolate tenant data.
2. Enable logging for all database query operations.
3. Conduct regular security reviews of multi-tenant applications.
4. Apply the principle of least privilege to all user roles.

Workaround (if patching is not immediately possible):

• Disable the database query tool entirely by removing or blocking access to the /api/query and /admin/query endpoints.
• Implement a web application firewall (WAF) rule to block suspicious query patterns.

Valters IT