CVE-2026-30856 json
WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection
published 2026-03-06 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-10179 , GHSA-67q9-58vj-32qx , GO-2026-4638
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming convention in the MCP client (mcp_{service}_{tool}), an attacker can register a malicious tool that overwrites a legitimate one (e.g., tavily_extract). This enables the attacker to redirect LLM execution flow, exfiltrate system prompts, context, and potentially execute other tools with the user's privileges. This issue has been patched in version 0.3.0.
Patch / fix
- go github.com/Tencent/WeKnora 0.3.0
- tencent weknora 0.3.0
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260317T205859-150000.1.152.1
suse advisories SUSE-SU-2026:1042-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Tencent/WeKnora/security/advisories/GHSA-67q9-58vj-32qx referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/Tencent/WeKnora | <0.3.0 all versions |
0.3.0 |
Affected products
- Tencent WeKnora
Classification
- Weakness
-
- CWE-706 Use of Incorrectly-Resolved Name or Reference
References
-
github.com
/Tencent/WeKnora/security/advisories/GHSA-67q9-58vj-32qx
web, exploit, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-30856
advisory
-
forum.cursor.com
/t/mcp-tools-name-collision-causing-cross-service-tool-call-failures/70946
web
-
github.com
/Tencent/WeKnora
package
-
modelcontextprotocol-security.io
/ttps/tool-poisoning/tool-name-conflict
web
-
elastic.co
/security-labs/mcp-tools-attack-defense-recommendations#tool-name-collision
web
Sources
- CVE List CVE-2026-30856
- GitHub Advisory GHSA-67q9-58vj-32qx
- NVD CVE-2026-30856
- OSV GO-2026-4638
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.