Go/github.com/Tencent/WeKnora CVE-2026-30856: unknown, EPSS 0.31%
WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection in github.com/Tencent/WeKnora
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-4638
- https://github.com/Tencent/WeKnora/security/advisories/GHSA-67q9-58vj-32qx
- https://forum.cursor.com/t/mcp-tools-name-collision-causing-cross-service-tool-call-failures/70946
- https://modelcontextprotocol-security.io/ttps/tool-poisoning/tool-name-conflict
- https://www.elastic.co/security-labs/mcp-tools-attack-defense-recommendations#tool-name-collision
CVE-2026-30856 · published · modified · JSON