CVE-2026-17434
Received Received - Intake

Improper Authorization in NanoClaw up to 2.0.64

Publication date: 2026-07-26

Last updated on: 2026-07-26

Assigner: VulDB

Description
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-26
Last Modified
2026-07-26
Generated
2026-07-26
AI Q&A
2026-07-26
EPSS Evaluated
N/A
NVD
CVE-2026-17434
EUVD
EUVD-2026-49049

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nanocoai nanoclaw to 2.0.64 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in NanoClaw up to version 2.0.64 allows attackers to bypass approval safeguards by submitting hidden command-line arguments or environment variables in the add_mcp_server function. The approval UI only displays the server name and command, while the full payload with sensitive parameters is stored and later applied to the runtime configuration. This enables unauthorized command execution or code injection.

Detection Guidance

Check NanoClaw versions up to 2.0.64 for the vulnerable function handleAddMcpServer in src/modules/self-mod/request.ts. Inspect approval flows for hidden args and env parameters not displayed in the UI. Verify if approval cards show full payloads including sensitive fields.

Impact Analysis

An attacker could exploit this to execute unauthorized commands on your system, inject malicious code, or alter runtime configurations without your knowledge. Since approvals are bypassed, even trusted requests may contain hidden harmful parameters that persist in your environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. The lack of proper authorization checks undermines compliance with data protection principles.

Mitigation Strategies

Apply the patch e5b928783d5c485637565eb07d2967922dfbf8d8. Update NanoClaw to a version beyond 2.0.64. Review and revoke any pending approvals created before the patch. Monitor for unauthorized runtime configuration changes or command executions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17434. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart