CVE-2026-22687 is a medium severity SQL injection flaw (CVSS 5.6) in Tencent WeKnora, the LLM powered document framework, before version 0.2.5. With the Agent service enabled, prompt based techniques bypass the limits on the database query tool. The fix is WeKnora 0.2.5, so upgrade.
What's affected
Tencent WeKnora before 0.2.5, when the Agent service is enabled. The fixed version is 0.2.5.
The flaw is in the database query tool, which the advisory places in internal/agent/tools/database_query.go in the SQL validation function.
How to check if you're exposed
Check the WeKnora version in your deployment, by the container image tag or release you installed.
Then check whether the Agent service is enabled. If it is off, the query tool the record describes is not reachable. If it is on, list which users can chat with the agent.
What to do now
- Upgrade WeKnora to 0.2.5 or later.
- If you cannot upgrade yet, switch the Agent service off.
- Run the database account used by the tool with the least rights it needs, and avoid sharing it with other applications.
- Review agent chat logs for requests that ask the tool to run unusual queries.
- Treat tools you give to an LLM agent as an attack surface and test them with hostile prompts.
Why it matters
The weakness is CWE-89, SQL injection. The record says the backend checks on queries were insufficient, so an attacker could use prompt based bypass techniques to get around the restrictions and read sensitive information from the server and database.
The advisory describes two gaps in the validation: dangerous built in database functions were not blocked, and comments could stand in for spaces and slip past a pattern check. A text filter that tries to recognise safe SQL is hard to get right. Least privilege on the database account, with parameterised queries, is the stronger design.
The score is 5.6 because the vector shows high attack complexity and low impact on each axis. The advisory notes the effect could reach other tenants. The record does not say it is exploited in the wild, and it is not on the CISA KEV list.
Quick check
Does this need the Agent service?
Yes. The record says the issue arises after the Agent service is enabled and users can call the database query tool.
Why is a prompt involved in an SQL flaw?
The agent turns a prompt into a call to the query tool. Weak validation lets a crafted prompt produce a query the tool should have refused.
Sources
Last reviewed: 19 October 2026.
