CVE-2026-92576

HKUDS nanobot before 0.3.0 contains a server-side request forgery (CWE-918) in its WebFetchTool component: the _validate_url() function fails to block internal IP ranges, private (RFC 1918) addresses, and loopback targets. An attacker who can send messages to the bot simply instructs it to fetch URLs such as the cloud metadata endpoint (169.254.169.254), localhost services, or internal network addresses, and the tool performs the requests and returns the responses. This lets the attacker harvest IAM/cloud credentials from the metadata service and read data from internal services reachable from the host running the bot, with no privileges or user interaction required (CVSS 4.0 9.2 critical). Anyone running an affected version of nanobot with WebFetchTool enabled and reachable by untrusted message input is affected. There is currently no evidence of in-the-wild exploitation and no public proof-of-concept is known.

What to do: Upgrade nanobot to version 0.3.0 or later, which fixes the URL validation in WebFetchTool. If upgrading is not immediately possible, restrict who can send messages that trigger web fetches and apply network-level controls so hosts running nanobot cannot reach 169.254.169.254, localhost, or RFC 1918 ranges (e.g., metadata endpoint firewalling and egress filtering). Review cloud and proxy logs for unexpected requests to metadata or internal addresses originating from hosts running nanobot.