| Component | Nanobot |
| Severity | unscored (not scored yet) |
| Published (NVD) | 2026-06-01 |
| Last modified | 2026-06-02 |
| Affected versions | < 0.2.1 read from the advisory text: NVD has not published CPE data yet |
| Fixed in | 0.2.1 |
| Weakness | CWE-918 |
| CISA KEV | not listed |
NVD description
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying a forged activity with an attacker-controlled serviceUrl value. Attackers can poison the stored conversation reference by sending a crafted inbound activity to the Teams webhook, causing subsequent bot replies to transmit token-bearing Authorization header requests to an attacker-controlled host.
What to do
- Upgrade Nanobot to
0.2.1or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-49139
- https://github.com/HKUDS/nanobot/commit/232df45126bcf0f8fccd123d73714f202c8e8612
- https://github.com/HKUDS/nanobot/pull/4047
- https://github.com/HKUDS/nanobot/releases/tag/v0.2.1
- https://www.vulncheck.com/advisories/nanobot-ssrf-via-microsoft-teams-channel-serviceurl-poisoning
Other Nanobot CVEs
A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file na...
A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of...
A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/provider...
A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agen...
A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of...
A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent...