# CVE-2026-49139: HKUDS Nanobot SSRF and token disclosure in Microsoft Teams channel

Source: https://junglewise.ai/threats/cve-2026-49139-hkuds-nanobot-ssrf-and-token-disclosure-in-microsoft-teams  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-49139 · Severity: info · CVSS 7 · Published 2026-06-01

Nanobot, an AI agent framework, contains a security flaw in how it handles Microsoft Teams communications. An attacker can send a specially crafted message to the bot's web address that tricks the system into sending sensitive authentication tokens to a server controlled by the attacker. This could allow an unauthorized person to intercept credentials and potentially impersonate the bot or gain access to related Microsoft Bot Framework services.

Technologies: [HKUDS Nanobot](https://junglewise.ai/threats/technologies/nanobot). Vendors: [HKUDS](https://junglewise.ai/threats/vendors/hkuds).

## Quick answers

**Is CVE-2026-49139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49139 being exploited in the wild.

**How severe is CVE-2026-49139?** Informational severity, with a CVSS score of 7, published 1 June 2026.

**Which products and versions are affected?** HKUDS Nanobot < 0.2.1.

**Is there a fix for CVE-2026-49139?** A patch was published on 2026-05-29: Pull request merged to harden serviceUrl trust boundary Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49139 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49139?** Check whether you run HKUDS Nanobot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Nanobot's Microsoft Teams channel handler due to improper validation of the 'serviceUrl' field in inbound activity objects. An attacker can send a forged inbound activity to the Teams webhook (e.g., /api/messages) containing an attacker-controlled serviceUrl. The application stores this URL in its conversation reference metadata without verifying if it belongs to a trusted Microsoft domain. When the bot later generates a reply, it uses the poisoned URL as the destination and includes a Bot Framework bearer token in the Authorization header, leading to credential disclosure. This exploit is most effective when inbound webhook authentication is disabled or bypassed. The issue is fixed in version 0.2.1 by implementing a trusted-host allowlist for service URLs.

## Affected products

- HKUDS Nanobot < 0.2.1

## Timeline

- 2026-05-29: patched: Pull request merged to harden serviceUrl trust boundary
- 2026-06-01: advisory: NVD and VulnCheck advisories published
- 2026-06-01: disclosed

## References

- [https://github.com/HKUDS/nanobot/commit/232df45126bcf0f8fccd123d73714f202c8e8612](https://github.com/HKUDS/nanobot/commit/232df45126bcf0f8fccd123d73714f202c8e8612)
- [https://github.com/HKUDS/nanobot/pull/4047](https://github.com/HKUDS/nanobot/pull/4047)
- [https://github.com/HKUDS/nanobot/releases/tag/v0.2.1](https://github.com/HKUDS/nanobot/releases/tag/v0.2.1)
- [https://www.vulncheck.com/advisories/nanobot-ssrf-via-microsoft-teams-channel-serviceurl-poisoning](https://www.vulncheck.com/advisories/nanobot-ssrf-via-microsoft-teams-channel-serviceurl-poisoning)

## Related threats

- [HKUDS nanobot server-side request forgery in WebFetchTool](https://junglewise.ai/threats/cve-2026-92576-hkuds-nanobot-server-side-request-forgery-in-webfetchtool)
- [HKUDS nanobot argument injection in shell command execution](https://junglewise.ai/threats/cve-2026-90809-hkuds-nanobot-argument-injection-in-shell-command-execution)
- [HKUDS nanobot incomplete blacklist in shell command execution](https://junglewise.ai/threats/cve-2026-90808-hkuds-nanobot-incomplete-blacklist-in-shell-command-execution)
- [HKUDS nanobot path traversal in WhatsApp bridge](https://junglewise.ai/threats/cve-2026-48716-hkuds-nanobot-path-traversal-in-whatsapp-bridge)
- [HKUDS Nanobot denial of service in Matrix media download handler](https://junglewise.ai/threats/cve-2026-49140-hkuds-nanobot-denial-of-service-in-matrix-media-download-handler)