Is CVE-2026-92576 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92576 being exploited in the wild.

How severe is CVE-2026-92576?

High severity, with a CVSS score of 8.6, published 16 September 2026.

Is there a fix for CVE-2026-92576?

A patch was published on 2026-09-02: Version 0.3.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92576 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92576?

Check whether you run HKUDS Nanobot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92576: HKUDS nanobot server-side request forgery in WebFetchTool

CVE-2026-92576 · Severity: high · CVSS 8.6 · Published 2026-09-16

HKUDS nanobot is an AI agent framework that integrates with chat platforms like Telegram, Discord, and Slack. A server-side request forgery (SSRF) vulnerability in its web-fetching component allows attackers to send messages instructing the bot to fetch internal cloud metadata endpoints, private network services, and localhost addresses. This could enable theft of cloud credentials, enumeration of internal infrastructure, and access to sensitive data from services that trust the server's network identity.

Technologies: HKUDS Nanobot. Vendors: HKUDS.

Quick answers

Is CVE-2026-92576 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92576 being exploited in the wild.
How severe is CVE-2026-92576?: High severity, with a CVSS score of 8.6, published 16 September 2026.
Which products and versions are affected?: HKUDS Nanobot before 0.3.0.
Is there a fix for CVE-2026-92576?: A patch was published on 2026-09-02: Version 0.3.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92576 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92576?: Check whether you run HKUDS Nanobot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (CWE-918) in the _validate_url() function within WebFetchTool (nanobot/agent/tools/web.py). The function checks only that URLs use HTTP/HTTPS schemes and have a non-empty domain, but fails to validate the target IP against private, loopback, or link-local ranges. This allows requests to internal targets including AWS/GCP/Azure metadata endpoints (169.254.169.254), localhost services on arbitrary ports, and RFC 1918 private addresses. The underlying httpx.AsyncClient is configured with follow_redirects=True, enabling bypass through HTTP redirects to internal IPs. An unauthenticated attacker can send messages on any enabled chat channel to trigger exploitation, and the bot will execute the HTTP request from the server's privileged network context, returning sensitive responses (cloud credentials, service data) to the attacker. Patched in version 0.3.0.

Affected products

HKUDS nanobot before 0.3.0

Timeline

2026-09-16: disclosed: Public disclosure on GitHub Security Advisory
2026-09-02: patched: Version 0.3.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.