CVE-2026-49138: HKUDS Nanobot SSRF in web_fetch tool via redirect following

Executive brief

Nanobot is an AI-powered tool used for fetching web content. A security flaw in its web-fetching component allows attackers to trick the system into making unauthorized requests to internal or private network services. This could lead to the exposure of internal data or unauthorized access to private infrastructure that is not normally accessible from the internet.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Nanobot's web_fetch tool due to improper handling of HTTP redirects. The application uses the httpx library, which automatically follows 3xx Location headers. An attacker can provide a URL that passes initial validation but subsequently redirects to a loopback (127.0.0.1) or private IP address. Because the final resolved URL is not re-validated before the request is completed, the attacker can probe or interact with internal network services. This issue is fixed in version 0.2.1.

Affected products

• HKUDS nanobot-ai < 0.2.1

Timeline

• 2026-06-01: disclosed
• 2026-06-01: advisory
• 2026-07-27: patched: Advisory updated with patch details

References

• https://api.github.com/users/faketut
• https://github.com/faketut
• https://api.github.com/users/faketut/gists%7B/gist_id%7D
• https://api.github.com/users/faketut/repos
• https://avatars.githubusercontent.com/u/104810086?v=4
• https://api.github.com/users/faketut/events%7B/privacy%7D