Executive brief
HKUDS nanobot is an AI agent framework that integrates with chat platforms like Telegram, Discord, and Slack. A server-side request forgery (SSRF) vulnerability in its web-fetching component allows attackers to send messages instructing the bot to fetch internal cloud metadata endpoints, private network services, and localhost addresses. This could enable theft of cloud credentials, enumeration of internal infrastructure, and access to sensitive data from services that trust the server's network identity.
Technical details
The vulnerability is a server-side request forgery (CWE-918) in the _validate_url() function within WebFetchTool (nanobot/agent/tools/web.py). The function checks only that URLs use HTTP/HTTPS schemes and have a non-empty domain, but fails to validate the target IP against private, loopback, or link-local ranges. This allows requests to internal targets including AWS/GCP/Azure metadata endpoints (169.254.169.254), localhost services on arbitrary ports, and RFC 1918 private addresses. The underlying httpx.AsyncClient is configured with follow_redirects=True, enabling bypass through HTTP redirects to internal IPs. An unauthenticated attacker can send messages on any enabled chat channel to trigger exploitation, and the bot will execute the HTTP request from the server's privileged network context, returning sensitive responses (cloud credentials, service data) to the attacker. Patched in version 0.3.0.
Affected products
- HKUDS nanobot before 0.3.0
Timeline
- 2026-09-16: disclosed: Public disclosure on GitHub Security Advisory
- 2026-09-02: patched: Version 0.3.0 released with fix