Executive brief
Nanobot, an AI agent framework, contains a security flaw in how it handles Microsoft Teams communications. An attacker can send a specially crafted message to the bot's web address that tricks the system into sending sensitive authentication tokens to a server controlled by the attacker. This could allow an unauthorized person to intercept credentials and potentially impersonate the bot or gain access to related Microsoft Bot Framework services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Nanobot's Microsoft Teams channel handler due to improper validation of the 'serviceUrl' field in inbound activity objects. An attacker can send a forged inbound activity to the Teams webhook (e.g., /api/messages) containing an attacker-controlled serviceUrl. The application stores this URL in its conversation reference metadata without verifying if it belongs to a trusted Microsoft domain. When the bot later generates a reply, it uses the poisoned URL as the destination and includes a Bot Framework bearer token in the Authorization header, leading to credential disclosure. This exploit is most effective when inbound webhook authentication is disabled or bypassed. The issue is fixed in version 0.2.1 by implementing a trusted-host allowlist for service URLs.
Affected products
- HKUDS Nanobot < 0.2.1
Timeline
- 2026-05-29: patched: Pull request merged to harden serviceUrl trust boundary
- 2026-06-01: advisory: NVD and VulnCheck advisories published
- 2026-06-01: disclosed