Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

HKUDS nanobot lets attackers reach internal network data

CVE-2026-92576 · published 29 days ago
Summary

The HKUDS nanobot version before 0.3.0 can be tricked into contacting internal IP addresses, including the server itself and private network ranges. This lets a malicious user retrieve internal configuration, credentials or other sensitive information. Upgrade to version 0.3.0 or later, or apply a patch that blocks private‑network requests, to stop the risk.

What to do
  • Update hkuds nanobot to version 0.3.0 or later.
Affected software
VendorProductAffected versions
hkuds nanobot < 0.3.0
Original advisory text
HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost services, and RFC 1918 addresses to extract IAM credentials and internal service data.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published16 Sep 2026
Updated15 Oct 2026
First seen16 Sep 2026
Sources
CVE-2026-92576 · NVD
CVE-2026-92576 · MITRE
CVE-2026-92576 · OSV
GHSA-vc5v-6vwm-wf9m · GHSA
Track software like this
Free during beta