Medium severity · published Oct 12, 2026
CVE-2026-108821
Tencent WeKnora SQL Validator inject.go validateSubquery sql injection
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is recommended to address this issue. The identifier of the patch is d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WeKnora · Tencent
0.8.0; 0.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108821
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108821
vdb-entry
https://vuldb.com/vuln/416598
signature
https://vuldb.com/vuln/416598/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-108821
third-party-advisory
https://vuldb.com/submit/964272
exploit
https://gist.github.com/k4z01/8ab2f57b015825f8738ed536dd870877
issue-tracking
https://github.com/Tencent/WeKnora/pull/3305
More from WeKnora
9.8
CVE-2026-30860
WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
9.8
CVE-2026-22687
WeKnora vulnerable to SQL Injection
9.8
CVE-2025-11046
A security flaw has been discovered in Tencent WeKnora 0.1.0
8.8
CVE-2026-30861
WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
8.8
CVE-2026-30855
WeKnora: Broken Access Control in Tenant Management