CVE-2026-49138 Overview
CVE-2026-49138 is a Server-Side Request Forgery (SSRF) vulnerability in Nanobot prior to version 0.2.1. The flaw resides in the web_fetch tool, which validates user-supplied URLs but then follows HTTP 3xx redirects without re-validating the final destination. Remote attackers with low privileges can supply an external URL that issues a Location header pointing to loopback or private network addresses. The runtime then issues outbound requests to internal hosts, enabling reconnaissance of services not exposed to the public network. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated remote attackers can use the web_fetch tool to probe internal network services and metadata endpoints by abusing the automatic redirect-following behavior of the underlying httpx HTTP client.
Affected Products
- Nanobot (HKUDS) versions prior to 0.2.1
- The web_fetch tool component
- Deployments relying on httpx automatic redirect following
Discovery Timeline
- 2026-06-01 - CVE-2026-49138 published to the National Vulnerability Database
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-49138
Vulnerability Analysis
The vulnerability exists in the web_fetch tool of Nanobot. The tool accepts a URL from the caller and performs initial validation against the supplied value to block requests targeting internal or loopback addresses. However, the request is then dispatched through the httpx HTTP client with automatic redirect following enabled.
When the destination server responds with a 3xx status code and a Location header pointing to a private address such as 127.0.0.1, 169.254.169.254, or RFC1918 ranges, httpx transparently issues a follow-up request to that target. The runtime applies final URL validation only after the request has already been sent, defeating the original allow-list check.
Authenticated attackers can use this primitive to query internal HTTP services, cloud metadata endpoints, and administrative interfaces reachable from the Nanobot host.
Root Cause
The root cause is a time-of-check to time-of-use gap between URL validation and HTTP request dispatch. The initial allow-list filter inspects only the user-supplied URL string. The redirect chain produced by httpx is not subject to the same per-hop validation, so the effective destination diverges from the validated input.
Attack Vector
Exploitation requires network access to the Nanobot endpoint and low-privilege authentication. The attacker hosts an attacker-controlled web server that returns a 302 Found response with a Location header pointing to an internal resource. The attacker then invokes the web_fetch tool with the URL of their controlled server. Nanobot validates the public URL, dispatches the request, and follows the redirect into the internal network. Response data may be returned to the attacker depending on tool output handling.
The vulnerability mechanism is described in detail in the VulnCheck Security Advisory.
Detection Methods for CVE-2026-49138
Indicators of Compromise
- Outbound HTTP requests from the Nanobot process to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) following an external fetch
- Requests from Nanobot to loopback (127.0.0.0/8) or link-local (169.254.169.254) addresses
- web_fetch tool invocations where the destination host resolves to a public IP but the subsequent socket connects to a private one
Detection Strategies
- Inspect Nanobot application logs for HTTP 3xx responses immediately followed by requests to internal address space
- Correlate egress proxy logs with Nanobot tool-call audit logs to identify redirect chains crossing trust boundaries
- Alert on any access from the Nanobot service account to cloud instance metadata services such as http://169.254.169.254/
Monitoring Recommendations
- Force all outbound traffic from Nanobot through an egress proxy that enforces destination allow-listing
- Capture and retain full request URLs including the post-redirect target for the web_fetch tool
- Monitor for anomalous response sizes from the web_fetch tool that may indicate exfiltration of internal service responses
How to Mitigate CVE-2026-49138
Immediate Actions Required
- Upgrade Nanobot to version 0.2.1 or later, which contains the official fix
- Restrict the Nanobot host with network-level egress controls that block traffic to loopback, link-local, and RFC1918 destinations
- Rotate any credentials or tokens reachable via the affected host's metadata service if exploitation is suspected
Patch Information
The fix is published in the Nanobot v0.2.1 release. The corresponding code change is available in the GitHub commit 545294c and the GitHub pull request #3928. The patch re-validates the resolved destination after each redirect and rejects URLs that resolve to private or loopback ranges.
Workarounds
- Disable the web_fetch tool in deployments where upgrading is not immediately feasible
- Configure the httpx client used by Nanobot to disable automatic redirect following and reject 3xx responses
- Place the Nanobot service in a network segment with no route to internal management interfaces or cloud metadata endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
