nanocoai NanoClaw up to 2.0.64 add_mcp_server request.ts handleAddMcpServer improper authorization

Summaryinfo

A vulnerability was found in nanocoai NanoClaw up to 2.0.64. It has been rated as critical. Affected by this vulnerability is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. The manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-17434. Remote exploitation of the attack is possible. Furthermore, an exploit is available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in nanocoai NanoClaw up to 2.0.64. It has been rated as critical. This issue affects the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-17434. The exploitation is known to be easy. The attack may be initiated remotely. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

The exploit is available at github.com. It is declared as proof-of-concept.

Applying the patch e5b928783d5c485637565eb07d2967922dfbf8d8 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at CNNVD (CNNVD-2026-46897485) and EUVD (EUVD-2026-49049). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• nanocoai

Name

• NanoClaw

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21
• 2.0.22
• 2.0.23
• 2.0.24
• 2.0.25
• 2.0.26
• 2.0.27
• 2.0.28
• 2.0.29
• 2.0.30
• 2.0.31
• 2.0.32
• 2.0.33
• 2.0.34
• 2.0.35
• 2.0.36
• 2.0.37
• 2.0.38
• 2.0.39
• 2.0.40
• 2.0.41
• 2.0.42
• 2.0.43
• 2.0.44
• 2.0.45
• 2.0.46
• 2.0.47
• 2.0.48
• 2.0.49
• 2.0.50
• 2.0.51
• 2.0.52
• 2.0.53
• 2.0.54
• 2.0.55
• 2.0.56
• 2.0.57
• 2.0.58
• 2.0.59
• 2.0.60
• 2.0.61
• 2.0.62
• 2.0.63
• 2.0.64

License

• open-source

Website

• Product: https://github.com/nanocoai/nanoclaw/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #862451: NanoCoAI NanoClaw 2.0.64 Improper Authorization (CWE-285) (by Erichen-x)

Duplicate

• Submit #XXXXXX: Xxxxxxxx Xxxxxxxx X.x.xx Xxxxxxxx Xxxxxxxxxxxxx (xxx-xxx) (by JohnChen)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion