by Kastro
Paper/Archive/CVE-2026-92576

CVE-2026-92576

HKUDS nanobot — HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool

EPSS 0.4%public exploitCVSS 9.2
critical.is priorityof 100
45
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 38.7.387 × 207.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost services, and RFC 1918 addresses to extract IAM credentials and internal service data.

Affected

ProductAffectedFixed inSource
nanobot< 0.3.00.3.0CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
VulnCheck (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9mwriteupvulncheck.com/advisories/hkuds-nanobot-before-0.3.0-server-side-request-forgery-via-webfetchtool