CVE-2026-49139
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
SSRF vulnerability in Nanobot prior to version 0.2.1 in the Microsoft Teams channel handler. A remote attacker can forge an activity with a controlled serviceUrl value, leading to exfiltration of Bot Framework bearer tokens.
Risk Assessment
An attacker can steal bot tokens, allowing impersonation of the bot and access to sensitive data or functions.
Recommendation
Update Nanobot to version 0.2.1 or later.
Other vulnerabilities in Nanobot
See all- CVE-2026-49140Medium
Nanobot prior to version 0.2.1 has a denial of service vulnerability in the Matrix channel media download handler. Authenticated room members can exhaust process memory and bandwidth by sending media events with missing or invalid size metadata.
- CVE-2026-49138Medium
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool, allowing attackers to reach internal hosts via URL redirection to loopback or private addresses, exploiting automatic HTTP redirect following.
- CVE-2026-35589High
nanobot, a personal AI assistant, prior to version 0.1.5 contains a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the bridge's WebSocket server. The server does not validate the Origin header during the WebSocket handshake, and token authentication is disabled by default. Any website visited by a user running the bridge can establish a WebSocket connection and gain full access to the bridge API, allowing hijacking of the WhatsApp session, reading messages, stealing authentication QR codes, and sending messages on behalf of the user.
Original NVD description (English source)
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying a forged activity with an attacker-controlled serviceUrl value. Attackers can poison the stored conversation reference by sending a crafted inbound activity to the Teams webhook, causing subsequent bot replies to transmit token-bearing Authorization header requests to an attacker-controlled host.