CVE-2026-49138

Medium

Description

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the automatic HTTP redirect following behavior in the httpx library to bypass initial URL validation and cause the runtime to send outbound requests to internal hosts before final resolved URL validation is applied.

SeverityMedium

CVSS5.0

Exploit probability—

ProductNanobot-ai

PublishedJun 1, 2026

First seenJun 1, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

nanobot-ai0.2.1 or later

Patches

github.com/HKUDS/nanobot/commit/545294c62c0947da40eb5b65288aaf02b5fdf632

Vendor advisories

github.com/HKUDS/nanobot/releases/tag/v0.2.1

Affected products

Product	Affected versions	Fixed in
nanobot-aiPyPI	v < 0.2.1	0.2.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.