CVE-2026-30860

Executive Summary

CVE-2026-30860 is a critical remote code execution (RCE) vulnerability in WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval. The flaw resides in the application's database query functionality, where the validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions. This allows an unauthenticated attacker to bypass SQL injection protections and chain dangerous PostgreSQL functions with large object operations and library loading capabilities to achieve arbitrary code execution on the database server with database user privileges. The vulnerability has a CVSS score of 10.0, indicating maximum severity. The vendor has released a patch in version 0.2.12.

Supply Chain & Package Security

WeKnora is a Python-based framework distributed via PyPI. Organizations using WeKnora should verify their installed version and update to 0.2.12 or later. The vulnerability is introduced through the application's own code, not through a third-party dependency, but the risk of supply chain compromise is high if an attacker can inject malicious queries.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability affects only the database server.
• Confidentiality (C): High (H) – Full database and system data can be read.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – The database server can be taken offline or used for further attacks.

Threat Level: Critical. The CVSS score of 10.0 indicates that exploitation is trivial and impact is total.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection (CWE-89) with a twist: the validation logic in WeKnora's database query handler does not recursively inspect child nodes within PostgreSQL array expressions (e.g., ARRAY[...]) and row expressions (e.g., ROW(...)). This allows an attacker to smuggle dangerous PostgreSQL functions inside these constructs.

Attack Chain:

1. Bypass Validation: The attacker crafts a malicious SQL query that includes a PostgreSQL array or row expression. The validation system only checks the top-level structure, not the nested elements.
2. Inject Dangerous Functions: Inside the array/row expression, the attacker includes functions like lo_import, lo_export, pg_read_file, or pg_ls_dir. These functions are normally restricted but can be invoked if the database user has sufficient privileges.
3. Chain with Large Object Operations: The attacker uses lo_import to load a malicious shared library (e.g., a .so file) from the file system into the database.
4. Library Loading: Using CREATE FUNCTION or lo_import with a crafted library, the attacker achieves arbitrary code execution on the database server.

Example of a malicious query:

SELECT * FROM documents WHERE id = ARRAY[1, lo_import('/tmp/evil.so')];

In this example, the lo_import function is hidden inside an array expression, bypassing the validation.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.2.12):

def validate_query(query):
    # Only checks top-level nodes
    for node in query['select']:
        if is_dangerous(node):
            raise ValidationError("Dangerous function detected")
    return query

Patched Code (0.2.12):

def validate_query(query):
    # Recursively checks all nodes
    def recursive_check(node):
        if is_dangerous(node):
            raise ValidationError("Dangerous function detected")
        for child in get_children(node):
            recursive_check(child)
    recursive_check(query)
    return query

The patch introduces recursive validation to inspect child nodes within array and row expressions.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• WeKnora version 0.2.11 or earlier
• PostgreSQL database with a user that has superuser privileges (or at least pg_read_server_files and lo_import privileges)
• A malicious shared library (e.g., evil.so) placed in a directory accessible by the PostgreSQL server (e.g., /tmp/)

Exploitation Steps:

1. Craft the malicious query:

   SELECT * FROM documents WHERE id = ARRAY[1, lo_import('/tmp/evil.so')];
   

2. Send the query to the WeKnora API endpoint:

   curl -X POST http://target:5000/query -H "Content-Type: application/json" -d '{"query": "SELECT * FROM documents WHERE id = ARRAY[1, lo_import('"'"/tmp/evil.so"'"')];"}'
   

3. Verify code execution: The malicious library will execute, providing a reverse shell or other payload.

Note: No public exploit code is available at this time.

Blue Team (Defense)

Detection:

• Monitor database logs for unusual lo_import, lo_export, or pg_read_file calls.
• Look for SQL queries containing ARRAY or ROW expressions with embedded function calls.
• Use database activity monitoring (DAM) tools to alert on suspicious patterns.

Mitigation:

• Upgrade to WeKnora 0.2.12 immediately.
• Restrict database user privileges to the minimum required.
• Implement a Web Application Firewall (WAF) rule to block queries containing lo_import or lo_export.
• Enable PostgreSQL audit logging to capture all CREATE FUNCTION and lo_import events.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /query with JSON payloads containing ARRAY or ROW expressions.
  • Unusual outbound connections from the database server (e.g., reverse shell traffic).
• File System IOCs:
  • Presence of unexpected shared libraries (.so files) in /tmp/ or PostgreSQL data directories.
  • Modified PostgreSQL configuration files (e.g., postgresql.conf with dynamic_library_path changes).
• Database IOCs:
  • Large objects created with lo_import that are not associated with normal application operations.
  • New functions created with CREATE FUNCTION that reference external libraries.
• Log IOCs:
  • PostgreSQL logs showing ERROR: permission denied for function lo_import (if privileges are restricted).
  • WeKnora application logs showing validation failures or unexpected query structures.

Detection Engineering

YARA Rule

rule CVE_2026_30860_WeKnora_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2026-30860 in WeKnora"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-30860"
    strings:
        $s1 = "ARRAY[" ascii wide nocase
        $s2 = "ROW(" ascii wide nocase
        $s3 = "lo_import" ascii wide nocase
        $s4 = "lo_export" ascii wide nocase
        $s5 = "pg_read_file" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2026-30860 WeKnora SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts exploiting CVE-2026-30860 in WeKnora
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: weknora
detection:
    selection:
        http.method: POST
        http.url: /query
        http.body|contains|all:
            - 'ARRAY['
            - 'lo_import'
    condition: selection
falsepositives:
    - Legitimate use of array expressions with lo_import (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-30860 WeKnora SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/query"; http_uri; content:"ARRAY["; http_client_body; content:"lo_import"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WeKnora to version 0.2.12 or later.
2. Restrict database user privileges to the minimum required (e.g., remove superuser and pg_read_server_files roles).
3. Implement a WAF rule to block SQL queries containing lo_import, lo_export, or pg_read_file.
4. Enable PostgreSQL audit logging to capture all CREATE FUNCTION and lo_import events.

Long-term Measures:

• Conduct a security review of all database query validation logic.
• Implement parameterized queries (prepared statements) to prevent SQL injection.
• Regularly update all dependencies and frameworks.
• Monitor for unusual database activity using a SIEM or DAM solution.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For further assistance, contact your Valters IT representative.