CVE-2026-49138
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool, allowing attackers to reach internal hosts via URL redirection to loopback or private addresses, exploiting automatic HTTP redirect following.
Risk Assessment
SSRF attack can enable internal network scanning, access to internal services, or data exfiltration from otherwise inaccessible systems.
Recommendation
Upgrade Nanobot to version 0.2.1 or later, which includes a fix for URL validation after redirection.
Other vulnerabilities in Nanobot
See all- CVE-2026-49140Medium
Nanobot prior to version 0.2.1 has a denial of service vulnerability in the Matrix channel media download handler. Authenticated room members can exhaust process memory and bandwidth by sending media events with missing or invalid size metadata.
- CVE-2026-49139High
SSRF vulnerability in Nanobot prior to version 0.2.1 in the Microsoft Teams channel handler. A remote attacker can forge an activity with a controlled serviceUrl value, leading to exfiltration of Bot Framework bearer tokens.
- CVE-2026-35589High
nanobot, a personal AI assistant, prior to version 0.1.5 contains a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the bridge's WebSocket server. The server does not validate the Origin header during the WebSocket handshake, and token authentication is disabled by default. Any website visited by a user running the bridge can establish a WebSocket connection and gain full access to the bridge API, allowing hijacking of the WhatsApp session, reading messages, stealing authentication QR codes, and sending messages on behalf of the user.
Original NVD description (English source)
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the automatic HTTP redirect following behavior in the httpx library to bypass initial URL validation and cause the runtime to send outbound requests to internal hosts before final resolved URL validation is applied.