CVE-2026-2577

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2577", "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "state": "PUBLISHED", "assignerShortName": "tenable", "dateReserved": "2026-02-16T09:39:50.906Z", "datePublished": "2026-02-16T09:51:11.375Z", "dateUpdated": "2026-02-17T16:43:29.855Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "nanobot", "vendor": "HKUDS", "versions": [{"lessThan": "0.1.3.Post7", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2026-02-16T09:47:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes."}], "value": "The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable", "dateUpdated": "2026-02-16T09:51:11.375Z"}, "references": [{"url": "https://www.tenable.com/security/research/tra-2026-09"}, {"url": "https://github.com/HKUDS/nanobot/releases/tag/v0.1.3.post7"}], "source": {"discovery": "UNKNOWN"}, "title": "Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T16:43:23.441404Z", "id": "CVE-2026-2577", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:43:29.855Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2577", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-17T16:43:23.441404Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:43:26.520Z"}}], "cna": {"title": "Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HKUDS", "product": "nanobot", "versions": [{"status": "affected", "version": "0", "lessThan": "0.1.3.Post7", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-16T09:47:00.000Z", "references": [{"url": "https://www.tenable.com/security/research/tra-2026-09"}, {"url": "https://github.com/HKUDS/nanobot/releases/tag/v0.1.3.post7"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.", "supportingMedia": [{"type": "text/html", "value": "The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable", "dateUpdated": "2026-02-16T09:51:11.375Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2577", "state": "PUBLISHED", "dateUpdated": "2026-02-17T16:43:29.855Z", "dateReserved": "2026-02-16T09:39:50.906Z", "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "datePublished": "2026-02-16T09:51:11.375Z", "assignerShortName": "tenable"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "nanobot", "vendor": "HKUDS", "versions": [{"lessThan": "0.1.3.Post7", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "vulnreport@tenable.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes."}, {"lang": "es", "value": "El componente de puente de WhatsApp en Nanobot enlaza el servidor WebSocket a todas las interfaces de red (0.0.0.0) en el puerto 3001 por defecto y no requiere autenticaci\u00f3n para las conexiones entrantes. Un atacante remoto no autenticado con acceso de red al puente puede conectarse al servidor WebSocket para secuestrar la sesi\u00f3n de WhatsApp. Esto permite al atacante enviar mensajes en nombre del usuario, interceptar todos los mensajes y medios entrantes en tiempo real, y capturar c\u00f3digos QR de autenticaci\u00f3n."}], "id": "CVE-2026-2577", "lastModified": "2026-06-17T10:31:20.727", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.8, "source": "vulnreport@tenable.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2577", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T16:43:23.441404Z", "version": "2.0.3"}}]}, "published": "2026-02-16T10:16:08.827", "references": [{"source": "vulnreport@tenable.com", "url": "https://github.com/HKUDS/nanobot/releases/tag/v0.1.3.post7"}, {"source": "vulnreport@tenable.com", "url": "https://www.tenable.com/security/research/tra-2026-09"}], "sourceIdentifier": "vulnreport@tenable.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "vulnreport@tenable.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.1.3.Post7)"}}], "product": "nanobot", "vendor": "hkuds"}], "analysis": {"en": {"generated_at": "2026-04-17T19:10:04.104375+00:00", "value": {"mitigation_remediation": ["Upgrade Nanobot to the latest release (v0.1.3.post7 or newer) that addresses the unauthenticated WebSocket interface.", "If an upgrade is not immediately possible, restrict access to port 3001 with firewall rules, permitting only trusted hosts or the local loopback interface.", "Verify that the WebSocket server is bound only to 127.0.0.1; if it remains bound to 0.0.0.0, reconfigure it to listen on localhost or disable the bridge when not needed.", "Monitor logs for unauthorized WebSocket connections and consider disabling the feature if it is not required for your deployment."], "summary": {"action": "Apply Patch", "impact": "WhatsApp session hijack"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Nanobot installations by HKUDS that use the default WebSocket server configuration. All versions released before the latest known fix (v0.1.3.post7) are potentially vulnerable. Current version information beyond the release tag is not provided, so any deployment using the default interface binding is at risk.", "description_and_impact": "Nanobot\u2019s WhatsApp bridge defaults to listening on all network interfaces (0.0.0.0) and does not enforce authentication. An attacker who can reach port 3001 can connect via WebSocket, hijack the WhatsApp session, send messages as the user, intercept all inbound messages and media, and capture authentication QR codes. This vulnerability permits full control of the user\u2019s messaging session without user credentials.", "risk_and_exploitability": "The CVSS score of 10 assigns critical severity, yet the EPSS score of less than 1% indicates a low likelihood of exploitation currently. This vulnerability is not yet listed in CISA\u2019s KEV catalog, suggesting no confirmed public exploits. Nonetheless, anyone who can reach Nanobot\u2019s WebSocket on port 3001 has a direct path to hijack a WhatsApp session, allowing message spoofing, interception, and QR\u2011code theft, which could compromise user confidentiality and trust."}}}}, "created": "2026-02-16T12:00:58.449072+00:00", "updated": "2026-04-17T19:15:26.255356+00:00", "vendors": ["hkuds", "hkuds$PRODUCT$nanobot"]}