CRITICAL 9.2 NVD
CVE-2026-92576
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost services, and RFC 1918 addresses to extract IAM credentials and internal service data.
References
- https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m
- https://www.vulncheck.com/advisories/hkuds-nanobot-before-0.3.0-server-side-request-forger
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-09-16 via NVD.
Risk Timeline
CVE Disclosed2026-09-16 · -1 days ago
Remediation Resources
vulnfeed aggregates 14597 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.