CVE-2026-49138 json
Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following
published 2026-06-01 5 mo ago modified 2026-11-08 22 h ago also EUVD-2026-33757 , GHSA-434r-7c99-hwf3 , PYSEC-2026-3580
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the automatic HTTP redirect following behavior in the httpx library to bypass initial URL validation and cause the runtime to send outbound requests to internal hosts before final resolved URL validation is applied.
Patch / fix
- pypi nanobot-ai 0.2.1
- HKUDS nanobot 0.2.1
- github.com/HKUDS/nanobot@545294c commit
- github.com/HKUDS/nanobot#3928 pull request
- github.com/HKUDS/nanobot/releases/tag/v0.2.1 release
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/HKUDS/nanobot/pull/3928 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N |
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| OSV | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nanobot-ai | <0.2.1 |
0.2.1 |
Affected products
- HKUDS nanobot
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/HKUDS/nanobot/pull/3928
issue-tracking, patch, exploit, web
-
github.com
/HKUDS/nanobot/commit/545294c62c0947da40eb5b65288aaf02b5fdf632
patch, web
-
github.com
/HKUDS/nanobot/releases/tag/v0.2.1
release-notes, web
-
vulncheck.com
/advisories/nanobot-ssrf-via-web-fetch-tool-redirect-following
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-49138
advisory
-
github.com
/HKUDS/nanobot
package
-
pypi.org
/project/nanobot-ai
package
-
github.com
/advisories/GHSA-434r-7c99-hwf3
advisory
Sources
- CVE List CVE-2026-49138
- GitHub Advisory GHSA-434r-7c99-hwf3
- NVD CVE-2026-49138
- OSV PYSEC-2026-3580
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.