Description
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nanocoai | NanoClaw | 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.24, 2.0.25, 2.0.26, 2.0.27, 2.0.28, 2.0.29, 2.0.30, 2.0.31, 2.0.32, 2.0.33, 2.0.34, 2.0.35, 2.0.36, 2.0.37, 2.0.3… | — |
References
- VDB-383075 | nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization vdb-entry technical-description
- VDB-383075 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-17434 | CVE Analysis and Report third-party-advisory
- Submit #862451 | NanoCoAI NanoClaw 2.0.64 Improper Authorization (CWE-285) third-party-advisory
- https://github.com/nanocoai/nanoclaw/issues/2762 exploit issue-tracking
- https://github.com/nanocoai/nanoclaw/pull/2998 issue-tracking patch
- https://github.com/nanocoai/nanoclaw/commit/e5b928783d5c485637565eb07d2967922dfbf8d8 patch
- https://github.com/nanocoai/nanoclaw/ product