CVE-2026-17434: nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-26 · updated 2026-10-24
Weakness: CWE-266

Description

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.

Affected products

nanocoai NanoClaw: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+59)

References

https://github.com/nanocoai/nanoclaw/
https://github.com/nanocoai/nanoclaw/commit/e5b928783d5c485637565eb07d2967922dfbf8d8
https://github.com/nanocoai/nanoclaw/issues/2762
https://github.com/nanocoai/nanoclaw/pull/2998
https://vuldb.com/cve/CVE-2026-17434
https://vuldb.com/submit/862451
https://vuldb.com/vuln/383075
https://vuldb.com/vuln/383075/cti

Get alerted when CVE-2026-17434 or the next vulnerability affects your stack