CVE-2026-17434 — nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

Description (CNA)

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.

Affected (CNA)

Vendor / product	Versions
nanocoai / NanoClaw	affected 2.0.0; affected 2.0.1; affected 2.0.2; affected 2.0.3; affected 2.0.4; affected 2.0.5; affected 2.0.6; affected 2.0.7; affected 2.0.8; affected 2.0.9; affected 2.0.10; affected 2.0.11; affected 2.0.12; affected 2.0.13; affected 2.0.14; affected 2.0.15; affected 2.0.16; affected 2.0.17; affected 2.0.18; affected 2.0.19; affected 2.0.20; affected 2.0.21; affected 2.0.22; affected 2.0.23; affected 2.0.24; affected 2.0.25; affected 2.0.26; affected 2.0.27; affected 2.0.28; affected 2.0.29; affected 2.0.30; affected 2.0.31; affected 2.0.32; affected 2.0.33; affected 2.0.34; affected 2.0.35; affected 2.0.36; affected 2.0.37; affected 2.0.38; affected 2.0.39; affected 2.0.40; affected 2.0.41; affected 2.0.42; affected 2.0.43; affected 2.0.44; affected 2.0.45; affected 2.0.46; affected 2.0.47; affected 2.0.48; affected 2.0.49; affected 2.0.50; affected 2.0.51; affected 2.0.52; affected 2.0.53; affected 2.0.54; affected 2.0.55; affected 2.0.56; affected 2.0.57; affected 2.0.58; affected 2.0.59; affected 2.0.60; affected 2.0.61; affected 2.0.62; affected 2.0.63; affected 2.0.64

Vendor / product

Versions

nanocoai / NanoClaw

affected 2.0.0; affected 2.0.1; affected 2.0.2; affected 2.0.3; affected 2.0.4; affected 2.0.5; affected 2.0.6; affected 2.0.7; affected 2.0.8; affected 2.0.9; affected 2.0.10; affected 2.0.11; affected 2.0.12; affected 2.0.13; affected 2.0.14; affected 2.0.15; affected 2.0.16; affected 2.0.17; affected 2.0.18; affected 2.0.19; affected 2.0.20; affected 2.0.21; affected 2.0.22; affected 2.0.23; affected 2.0.24; affected 2.0.25; affected 2.0.26; affected 2.0.27; affected 2.0.28; affected 2.0.29; affected 2.0.30; affected 2.0.31; affected 2.0.32; affected 2.0.33; affected 2.0.34; affected 2.0.35; affected 2.0.36; affected 2.0.37; affected 2.0.38; affected 2.0.39; affected 2.0.40; affected 2.0.41; affected 2.0.42; affected 2.0.43; affected 2.0.44; affected 2.0.45; affected 2.0.46; affected 2.0.47; affected 2.0.48; affected 2.0.49; affected 2.0.50; affected 2.0.51; affected 2.0.52; affected 2.0.53; affected 2.0.54; affected 2.0.55; affected 2.0.56; affected 2.0.57; affected 2.0.58; affected 2.0.59; affected 2.0.60; affected 2.0.61; affected 2.0.62; affected 2.0.63; affected 2.0.64

CWE

CWE-285, CWE-266

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.