Medium severity · published Jul 26, 2026
CVE-2026-17433
nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
NanoClaw · nanocoai
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-17433
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-17433
github.com
https://github.com/nanocoai/nanoclaw/
github.com
https://github.com/nanocoai/nanoclaw/issues/2761
vuldb.com
https://vuldb.com/cve/CVE-2026-17433
vuldb.com
https://vuldb.com/submit/862450
vuldb.com
https://vuldb.com/vuln/383074
vuldb.com
https://vuldb.com/vuln/383074/cti
More from NanoClaw
7.3
CVE-2026-18991
nanocoai NanoClaw send_file core.ts path traversal
6.5
CVE-2026-56402
NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler
6.3
CVE-2026-90807
nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following
6.3
CVE-2026-19005
nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management
6.3
CVE-2026-17434
nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization