PT-2026-94093 · Hkuds · Nanobot
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
HKUDS nanobot versions prior to 0.3.0
Description
The WebFetchTool component contains a server-side request forgery (SSRF) issue, where the
validate url() function fails to block private addresses and internal IP ranges. This allows attackers to instruct the bot to fetch data from localhost services, RFC 1918 addresses, and cloud metadata endpoints to extract internal service data and IAM credentials.Recommendations
Update to version 0.3.0 or later.
As a temporary mitigation, restrict the use of the WebFetchTool component.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nanobot