CVE-2026-17434: Improper Authorization in nanocoai NanoClaw
Affects nanocoai NanoClawSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 30% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| nanocoaiNanoClaw | Affected
| Fixed in– |
GitHub Actionsnanocoai/nanoclawpkg:github/nanocoai/nanoclawOther threats | Affected
| Fixed in– |
CPE configurations (1)
cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 is available and should be applied to all affected versions up to 2.0.64. Since this is not a cloud service, users must manually update their installations to remediate the vulnerability. Patch status is confirmed by the presence of the patch commit; no further vendor advisory details are provided.
Description
CVE-2026-17434 is a medium severity vulnerability in nanocoai NanoClaw up to version 2.0.64. It involves improper authorization in the handleAddMcpServer function within the add_mcp_server component. The flaw can be exploited remotely to bypass authorization controls. An exploit has been published. A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 is available to remediate the issue.
Impact
Successful exploitation can lead to unauthorized actions on the affected NanoClaw component, potentially allowing attackers to manipulate the add_mcp_server functionality remotely. The impact is assessed as medium severity with limited confidentiality, integrity, and availability impact.
Summary
This vulnerability affects the handleAddMcpServer function in the src/modules/self-mod/request.ts file of the add_mcp_server component in nanocoai NanoClaw versions up to 2.0.64. The flaw allows remote attackers to perform unauthorized actions due to improper authorization checks. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 exists and should be applied.
References
- vuldb.com/vuln/383075 (opens in a new tab)
- vuldb.com/vuln/383075/cti (opens in a new tab)
- vuldb.com/cve/CVE-2026-17434 (opens in a new tab)
- vuldb.com/submit/862451 (opens in a new tab)
- github.com/nanocoai/nanoclaw/issues/2762 (opens in a new tab)
- github.com/nanocoai/nanoclaw/pull/2998 (opens in a new tab)
- github.com/nanocoai/nanoclaw/commit/e5b928783d5c485637565eb07d2967922dfbf8d8 (opens in a new tab)
- github.com/nanocoai/nanoclaw/ (opens in a new tab)