What is GHSA-mpqf-rmwr-h7wr?

GHSA-mpqf-rmwr-h7wr is a security advisory published by GitHub Security Advisories with Critical severity. HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the...

Which CVE IDs does GHSA-mpqf-rmwr-h7wr cover?

GHSA-mpqf-rmwr-h7wr covers the following CVE IDs: CVE-2026-92576. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mpqf-rmwr-h7wr?

GHSA-mpqf-rmwr-h7wr has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-mpqf-rmwr-h7wrCriticalCVSS 8.6

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-92576 →

📋 Description

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost services, and RFC 1918 addresses to extract IAM credentials and internal service data.

🔗 References (4)

https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m
https://nvd.nist.gov/vuln/detail/CVE-2026-92576
https://www.vulncheck.com/advisories/hkuds-nanobot-before-0.3.0-server-side-request-forgery-via-webfetchtool
https://github.com/advisories/GHSA-mpqf-rmwr-h7wr