WeKnora MCP Config-Driven RCE (CVE-2026-22688)

How the attack works

An attacker gains write access to the directory or file where WeKnora stores MCP plugin configs, without needing to authenticate to WeKnora itself. They add or modify an entry with a 'command' field pointing to an attacker-controlled executable or shell command. When the plugin loader next reads that config — on service restart, plugin reload, or scheduled sync — it executes the command as an OS process. This gives the attacker code execution on the WeKnora host, and because the malicious config persists on disk, the RCE survives restarts.

Netzilo detection

Why it matters

An attacker gets persistent remote code execution on the host running WeKnora, which can lead to data theft, lateral movement to other services sharing the host or volume, and tampering with the AI system's behavior since it now runs attacker-supplied code.

What you can do

• →Restrict write access to WeKnora's MCP plugin config directory to a trusted service account only; remove shared-volume or cross-tenant write paths.
• →Validate and pin plugin config files with checksums or signatures before the loader reads them, and reject unsigned or altered files.
• →Treat the 'command' field as untrusted input: run plugin loading in a sandboxed or least-privilege context rather than the main WeKnora process identity.
• →Audit config directories and CI/deployment pipelines for unexpected writes, and review any config file changes that introduce new or unfamiliar 'command' entries.

Known benign look-alikes

• WeKnora plugin development documentation showing example config layouts.
• Internal CI fixtures that include known-clean plugin configs for tests.
• Migration scripts that move plugin configs between environments with explicit integrity verification.

References

• https://agentthreatrule.org/en/rules/ATR-2026-00418
• https://nvd.nist.gov/vuln/detail/CVE-2026-22688

Related threats