Nanobot CVE-2026-49139

The bot must be a Nanobot instance prior to v0.2.1 with the Microsoft Teams channel handler configured and a publicly reachable Teams webhook endpoint (the CVSS AT:P 'Attack Requirements: Present' bit reflects this configuration prerequisite). No authentication, no privileges, and no user interaction are required (PR:N/UI:N) - the attacker only needs to POST a forged Activity payload to the webhook URL. Limiting factors: deployments not exposing a Teams channel are unaffected even on vulnerable versions; the value of stolen tokens is bounded by the permissions of the bot's Bot Framework app registration; and successful exfiltration requires the bot to actually send a reply after poisoning, so silent or one-shot bots may not trigger the outbound leak.

Signals are mixed but lean toward treating this as a meaningful priority for any operator running Nanobot with a Teams channel exposed. The CVSS 4.0 vector confirms network attack vector, low complexity, no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), with AT:P indicating an attack requirement (the bot must be configured for Teams and have a reachable webhook) - this is the realistic gating factor. Vulnerable-system impact is intentionally low (VC:N/VI:L/VA:N) because the bot itself is not compromised, but subsequent-system impact is High for both confidentiality and integrity (SC:H/SI:H) because leaked Bot Framework tokens permit impersonation of the bot tenant-wide. No EPSS score, no KEV listing, and no public POC are noted in the input, so the 7.0 score should be read as 'High because of downstream blast radius, not because of widespread active exploitation'. VulnCheck's involvement as reporter increases confidence the vulnerability is real and well-characterized.

An attacker who knows or guesses the public URL of a victim's Nanobot Teams webhook sends a single crafted inbound Activity JSON payload with a legitimate-looking conversation ID but a serviceUrl pointing at attacker.example.com. Nanobot stores that reference, and the next time the bot replies - to that conversation, or to any conversation whose reference was overwritten - it issues an authenticated HTTPS request to the attacker's host with the Bot Framework bearer token in the Authorization header, which the attacker then replays against graph.microsoft.com or smba.trafficmanager.net to impersonate the bot. No public exploit is identified at time of analysis, but the request shape is trivial to reproduce from the description.