CVE-2026-33654: Authentication Bypass in nanobot

The core of this vulnerability lies in the email channel processing module. An attacker can craft a malicious email containing carefully designed prompts. When nanobot automatically polls, ingests, and processes this email, it treats the content as highly trusted input, completely bypassing channel isolation. This results in a zero-click attack, meaning the bot owner doesn't need to interact with the email for the malicious instructions to be executed. The attacker can then leverage the LLM to execute system tools, potentially gaining unauthorized access and control over the system where nanobot is running. The stealthy nature of this attack, combined with the lack of user interaction, makes it particularly concerning.

1. Reserved2026-03-23
2. Published2026-03-27
3. Modified2026-03-30
4. EPSS updated2026-04-04

The primary mitigation is to upgrade nanobot to version 0.1.6 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing stricter input validation and sanitization on the email channel. While not a complete solution, this can help reduce the risk of malicious prompts being processed. Additionally, review and restrict the permissions granted to the LLM within nanobot to limit the potential impact of successful prompt injection. Monitor email logs for unusual activity or patterns that might indicate an attempted exploit.