CVE-2026-17434: nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper aut

Description

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nanocoai NanoClaw

2.0.0affected
2.0.1affected
2.0.2affected
2.0.3affected
2.0.4affected
2.0.5affected
2.0.6affected
2.0.7affected
2.0.8affected
2.0.9affected
2.0.10affected
2.0.11affected
2.0.12affected
2.0.13affected
2.0.14affected
2.0.15affected
2.0.16affected
2.0.17affected
2.0.18affected
2.0.19affected
2.0.20affected
2.0.21affected
2.0.22affected
2.0.23affected
2.0.24affected
2.0.25affected
2.0.26affected
2.0.27affected
2.0.28affected
2.0.29affected
2.0.30affected
2.0.31affected
2.0.32affected
2.0.33affected
2.0.34affected
2.0.35affected
2.0.36affected
2.0.37affected
2.0.38affected
2.0.39affected
2.0.40affected
2.0.41affected
2.0.42affected
2.0.43affected
2.0.44affected
2.0.45affected
2.0.46affected
2.0.47affected
2.0.48affected
2.0.49affected
2.0.50affected
2.0.51affected
2.0.52affected
2.0.53affected
2.0.54affected
2.0.55affected
2.0.56affected
2.0.57affected
2.0.58affected
2.0.59affected
2.0.60affected
2.0.61affected
2.0.62affected
2.0.63affected
2.0.64affected

CVE-2026-17434

nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

Description

Affected products

nanocoai NanoClaw

References