CVE-2026-35589: nanobot AI Assistant CSRF Vulnerability

CVE-2026-35589 Overview

CVE-2026-35589 is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in nanobot, a personal AI assistant application. This vulnerability exists in the bridge's WebSocket server located in bridge/src/server.ts and represents an incomplete remediation of a previous vulnerability (CVE-2026-2577). The original fix changed the binding from 0.0.0.0 to 127.0.0.1 and added an optional BRIDGE_TOKEN parameter, but token authentication is disabled by default and the server does not validate the Origin header during the WebSocket handshake.

Critical Impact

Any website visited by a user running the nanobot bridge can establish a WebSocket connection to ws://127.0.0.1:3001/ and gain full access to the bridge API, allowing attackers to hijack WhatsApp sessions, read incoming messages, steal authentication QR codes, and send messages on behalf of the user.

Affected Products

• nanobot versions prior to 0.1.5
• nanobot bridge WebSocket server component (bridge/src/server.ts)
• Users with active WhatsApp sessions through nanobot bridge

Discovery Timeline

• 2026-04-14 - CVE-2026-35589 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-35589

Vulnerability Analysis

This Cross-Site WebSocket Hijacking vulnerability stems from an incomplete security fix for CVE-2026-2577. While the original remediation addressed the network binding issue by restricting the WebSocket server to localhost (127.0.0.1), two critical security controls were left inadequate: token authentication remains disabled by default, and Origin header validation is absent during the WebSocket handshake process.

Browsers do not enforce the Same-Origin Policy on WebSocket connections unless the server explicitly denies cross-origin connections. Without Origin header validation, the nanobot bridge WebSocket server accepts connections from any web origin, including malicious websites. This architectural flaw allows attackers to leverage a victim's browser as a proxy to access the locally-bound WebSocket service.

The vulnerability is classified under CWE-1385 (Missing Origin Validation in WebSockets), highlighting the specific failure to implement proper cross-origin controls in WebSocket implementations.

Root Cause

The root cause is the missing Origin header validation during the WebSocket handshake in bridge/src/server.ts. Combined with the fact that BRIDGE_TOKEN authentication is optional and disabled by default, any website can establish a connection to the local WebSocket server running on port 3001. The assumption that binding to localhost provides sufficient protection is flawed, as browser-based attacks can still reach localhost services through the user's own browser.

Attack Vector

The attack requires user interaction in the form of visiting a malicious website while the nanobot bridge is running. The attacker hosts a webpage containing malicious JavaScript that attempts to establish a WebSocket connection to ws://127.0.0.1:3001/. Since the victim's browser originates the request and the server performs no Origin validation, the connection succeeds. Once connected, the attacker gains full access to the bridge API, enabling them to:

• Hijack the active WhatsApp session
• Read incoming and potentially outgoing messages
• Capture authentication QR codes for session persistence
• Send messages impersonating the victim

The vulnerability is exploited remotely through the network, though it requires the victim to visit a malicious page while the vulnerable service is running locally.

Detection Methods for CVE-2026-35589

Indicators of Compromise

• Unexpected WebSocket connections to 127.0.0.1:3001 from browser processes
• Unusual cross-origin WebSocket handshake attempts with non-matching Origin headers
• Unexplained WhatsApp messages sent from the user's account
• Suspicious QR code authentication requests or session duplications

Detection Strategies

• Monitor local network traffic for WebSocket connections to port 3001 originating from browser processes
• Implement browser-level monitoring for JavaScript initiating connections to localhost services
• Review nanobot bridge logs for connection attempts from unexpected origins
• Deploy endpoint detection rules for CSWSH attack patterns targeting local WebSocket services

Monitoring Recommendations

• Enable verbose logging on the nanobot bridge to capture connection origin information
• Set up alerts for multiple rapid WebSocket connection attempts to local services
• Monitor browser process network activity for connections to localhost WebSocket endpoints
• Implement user behavior analytics to detect anomalous messaging patterns through WhatsApp

How to Mitigate CVE-2026-35589

Immediate Actions Required

• Upgrade nanobot to version 0.1.5 or later immediately
• If unable to upgrade, enable the BRIDGE_TOKEN parameter and configure a strong authentication token
• Temporarily disable the nanobot bridge when not actively in use
• Avoid visiting untrusted websites while the nanobot bridge is running

Patch Information

The vulnerability has been fixed in nanobot version 0.1.5. Users should update to this version or later to receive the security patch. The fix implements proper Origin header validation during the WebSocket handshake to prevent cross-origin connections from unauthorized sources.

For more information, refer to the GitHub Nanobot Release v0.1.5 and the GitHub Security Advisory GHSA-v5j3-4q66-58cf.

Workarounds

• Enable the BRIDGE_TOKEN environment variable with a strong, randomly generated token value
• Use a local firewall to restrict access to port 3001, allowing only trusted applications
• Run the nanobot bridge in an isolated environment or container with restricted network access
• Consider using browser extensions that block JavaScript from making connections to localhost services

# Configuration example: Enable token authentication for nanobot bridge
export BRIDGE_TOKEN="your-strong-random-token-here"

# Alternatively, restrict port access using iptables (Linux)
iptables -A INPUT -p tcp --dport 3001 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3001 -j DROP