Go/github.com/Tencent/WeKnora CVE-2026-30856: medium 5.4, EPSS 0.27%
WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection
Action: Upgrade github.com/Tencent/WeKnora to 0.3.0 or later.
go get github.com/Tencent/WeKnora@v0.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.3.0 | - |
Fixed versions
| 0.3.0 |
Sources
- osv: GHSA-67q9-58vj-32qx
- https://github.com/Tencent/WeKnora/security/advisories/GHSA-67q9-58vj-32qx
- https://nvd.nist.gov/vuln/detail/CVE-2026-30856
- https://forum.cursor.com/t/mcp-tools-name-collision-causing-cross-service-tool-call-failures/70946
- https://github.com/Tencent/WeKnora
- https://modelcontextprotocol-security.io/ttps/tool-poisoning/tool-name-conflict
- https://www.elastic.co/security-labs/mcp-tools-attack-defense-recommendations#tool-name-collision
CVE-2026-30856 · published · modified · JSON