Critical severity · published Feb 16, 2026
CVE-2026-2577
Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
10.0
CVSS
0.7%
EPSS
No
On KEV
Description
The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
nanobot · HKUDS
before 0.1.3.Post7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2577
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2577
github.com
https://github.com/HKUDS/nanobot/releases/tag/v0.1.3.post7
www.tenable.com
https://www.tenable.com/security/research/tra-2026-09
More from nanobot
9.8
CVE-2026-33654
Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
9.3
CVE-2026-35589
nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)
8.7
CVE-2026-48716
nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write
8.6
CVE-2026-92576
HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
7.0
CVE-2026-49139
Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning