CVE-2026-17434: Improper Authorization in nanocoai NanoClaw
CVE-2026-17434 is a medium severity vulnerability in nanocoai NanoClaw up to version 2.0.64. It involves improper authorization in the handleAddMcpServer function within the add_mcp_server component. The flaw can be exploited remotely to bypass authorization controls. An exploit has been published. A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 is available to remediate the issue.
AI Analysis
Technical Summary
This vulnerability affects the handleAddMcpServer function in the src/modules/self-mod/request.ts file of the add_mcp_server component in nanocoai NanoClaw versions up to 2.0.64. The flaw allows remote attackers to perform unauthorized actions due to improper authorization checks. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 exists and should be applied.
Potential Impact
Successful exploitation can lead to unauthorized actions on the affected NanoClaw component, potentially allowing attackers to manipulate the add_mcp_server functionality remotely. The impact is assessed as medium severity with limited confidentiality, integrity, and availability impact.
Mitigation Recommendations
A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 is available and should be applied to all affected versions up to 2.0.64. Since this is not a cloud service, users must manually update their installations to remediate the vulnerability. Patch status is confirmed by the presence of the patch commit; no further vendor advisory details are provided.
CVE-2026-17434: Improper Authorization in nanocoai NanoClaw
Description
CVE-2026-17434 is a medium severity vulnerability in nanocoai NanoClaw up to version 2.0.64. It involves improper authorization in the handleAddMcpServer function within the add_mcp_server component. The flaw can be exploited remotely to bypass authorization controls. An exploit has been published. A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 is available to remediate the issue.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/nanocoai/nanoclawcpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the handleAddMcpServer function in the src/modules/self-mod/request.ts file of the add_mcp_server component in nanocoai NanoClaw versions up to 2.0.64. The flaw allows remote attackers to perform unauthorized actions due to improper authorization checks. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 exists and should be applied.
Potential Impact
Successful exploitation can lead to unauthorized actions on the affected NanoClaw component, potentially allowing attackers to manipulate the add_mcp_server functionality remotely. The impact is assessed as medium severity with limited confidentiality, integrity, and availability impact.
Mitigation Recommendations
A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 is available and should be applied to all affected versions up to 2.0.64. Since this is not a cloud service, users must manually update their installations to remediate the vulnerability. Patch status is confirmed by the presence of the patch commit; no further vendor advisory details are provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-25T11:08:25.395Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a65848b9c2644c7f8ae6812
Added to database: 07/26/2026, 03:52:43 UTC
Last enriched: 08/02/2026, 21:08:49 UTC
Last updated: 09/07/2026, 22:52:09 UTC
Views: 130
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.