CVE-2026-17433
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In nanocoai NanoClaw up to version 2.0.64, a vulnerability was detected in the createChatSdkBridge.setup function of the file src/channels/chat-sdk-bridge.ts in the MCP Server Approval component. Manipulation results in improper authorization. The attack requires local access. The exploit is public. The project was informed but has not responded.
Risk Assessment
Risk of unauthorized MCP server approval by a local attacker, potentially leading to privilege escalation or unauthorized actions.
Recommendation
Restrict local access to the system and monitor activity. Consider applying temporary mitigations until an official patch is released.
Other vulnerabilities in NanoClaw
See all- CVE-2026-56694Medium
NanoClaw before version 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups.
- CVE-2026-56693Medium
NanoClaw before version 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations, escalating beyond their intended confinement boundary.
- CVE-2026-56402Medium
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation.
- CVE-2026-19005Medium
A vulnerability in nanocoai NanoClaw up to 2.0.64 affects the function handleCreateAgent in src/modules/agent-to-agent/create-agent.ts, causing improper privilege management. Remote exploitation is possible and exploit is public.
- CVE-2026-18991High
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64, affecting an unknown part of the file container/agent-runner/src/mcp-tools/core.ts in the send_file component. Manipulation leads to path traversal, allowing remote attack. The exploit has been publicly disclosed and may be used.
- CVE-2026-17434Medium
In nanocoai NanoClaw up to version 2.0.64, a vulnerability was found in the handleAddMcpServer function of the file src/modules/self-mod/request.ts in the add_mcp_server component. Manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been published. A patch is available with ID e5b928783d5c485637565eb07d2967922dfbf8d8.
- CVE-2026-56692Medium
NanoClaw before version 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only isSafeAttachmentName, which allows malicious agents to disclose arbitrary host files.
Original NVD description (English source)
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.