CVE-2026-2577

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-257707.2Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version CVE-2026-257717.5Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version CVE-2026-257727.2Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version CVE-2026-257736.5** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements CVE-2026-257745.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-257759.8A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authe CVE-2026-257769.3Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script CVE-2026-257787.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-257796.1Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.CVE-2026-25784.3Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members CVE-2026-257804.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which CVE-2026-257818.4in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.