Is CVE-2026-91750 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-91750?

CVE-2026-91750 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-91750

Description

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.