| Component | NanoClaw |
| Severity | medium (CVSS 6.3) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| Published (NVD) | 2026-07-26 |
| Last modified | 2026-07-27 |
| Affected versions | <= 2.0.64 read from the advisory text: NVD has not published CPE data yet |
| Fixed in | see the vendor advisory |
| Weakness | CWE-266CWE-285 |
| CISA KEV | not listed |
NVD description
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep NanoClaw off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-17434
- https://github.com/nanocoai/nanoclaw/
- https://github.com/nanocoai/nanoclaw/commit/e5b928783d5c485637565eb07d2967922dfbf8d8
- https://github.com/nanocoai/nanoclaw/issues/2762
- https://github.com/nanocoai/nanoclaw/pull/2998
- https://vuldb.com/cve/CVE-2026-17434
- https://vuldb.com/submit/862451
- https://vuldb.com/vuln/383075
- https://vuldb.com/vuln/383075/cti
Other NanoClaw CVEs
A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/ag...
A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runne...
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-...
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels...
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalRes...
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder...