CVE-2026-2577

The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.

• CWE-306

• https://github.com/HKUDS/nanobot/releases/tag/v0.1.3.post7
• https://www.tenable.com/security/research/tra-2026-09

Published

Feb 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25764OpenProject is an open-source, web-based project management …3.5
• CVE-2026-25765Faraday is an HTTP client library abstraction layer that pro…5.8
• CVE-2026-25766Echo is a Go web framework. In versions 5.0.0 through 5.0.2 …5.3
• CVE-2026-25767LavinMQ is a high-performance message queue & streaming serv…8.1
• CVE-2026-25768LavinMQ is a high-performance message queue & streaming serv…6.5
• CVE-2026-25769Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-25770Wazuh is a free and open source platform used for threat pre…7.2
• CVE-2026-25771Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-25772Wazuh is a free and open source platform used for threat pre…7.2
• CVE-2026-25773** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails…6.5
• CVE-2026-25774Charging station authentication identifiers are publicly acc…5.3
• CVE-2026-25775A vulnerability in SenseLive X3050’s remote management servi…9.8