ByteOS Network

CVE Vulnerability Details :

CVE-2026-17434

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-26 Jul, 2026 | 03:00

Updated At-27 Jul, 2026 | 14:37

▼CVE Numbering Authority (CNA)

nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.

Affected Products

Vendor

nanocoai

Product

NanoClaw

CPEs

cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*

Modules

add_mcp_server

Versions

Affected

2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.27
2.0.28
2.0.29
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.36
2.0.37
2.0.38
2.0.39
2.0.40
2.0.41
2.0.42
2.0.43
2.0.44
2.0.45
2.0.46
2.0.47
2.0.48
2.0.49
2.0.50
2.0.51
2.0.52
2.0.53
2.0.54
2.0.55
2.0.56
2.0.57
2.0.58
2.0.59
2.0.60
2.0.61
2.0.62
2.0.63
2.0.64

Problem Types

Type	CWE ID	Description
CWE	CWE-285	Improper Authorization
CWE	CWE-266	Incorrect Privilege Assignment

Type: CWE

CWE ID: CWE-285

Description: Improper Authorization

Type: CWE

CWE ID: CWE-266

Description: Incorrect Privilege Assignment

Metrics

Version	Base score	Base severity	Vector
4.0	5.3	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
3.0	6.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2.0	6.5	N/A	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Version: 4.0

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Version: 3.0

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Version: 2.0

Base score: 6.5

Base severity: N/A

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Credits

reporter

Erichen-x (VulDB User)

Timeline

Event	Date
Advisory disclosed	2026-07-25 00:00:00
VulDB entry created	2026-07-25 02:00:00
VulDB entry last update	2026-07-25 13:13:39

Event: Advisory disclosed

Date: 2026-07-25 00:00:00

Event: VulDB entry created

Date: 2026-07-25 02:00:00

Event: VulDB entry last update

Date: 2026-07-25 13:13:39

References

Hyperlink	Resource
https://vuldb.com/vuln/383075	vdb-entry technical-description
https://vuldb.com/vuln/383075/cti	signature permissions-required
https://vuldb.com/cve/CVE-2026-17434	third-party-advisory
https://vuldb.com/submit/862451	third-party-advisory
https://github.com/nanocoai/nanoclaw/issues/2762	exploit issue-tracking
https://github.com/nanocoai/nanoclaw/pull/2998	issue-tracking patch
https://github.com/nanocoai/nanoclaw/commit/e5b928783d5c485637565eb07d2967922dfbf8d8	patch
https://github.com/nanocoai/nanoclaw/	product

Hyperlink: https://vuldb.com/vuln/383075

Resource:

vdb-entry

technical-description

Hyperlink: https://vuldb.com/vuln/383075/cti

Resource:

signature

permissions-required

Hyperlink: https://vuldb.com/cve/CVE-2026-17434

Resource:

third-party-advisory

Hyperlink: https://vuldb.com/submit/862451

Resource:

third-party-advisory

Hyperlink: https://github.com/nanocoai/nanoclaw/issues/2762

Resource:

exploit

issue-tracking

Hyperlink: https://github.com/nanocoai/nanoclaw/pull/2998

Resource:

issue-tracking

patch

Hyperlink: https://github.com/nanocoai/nanoclaw/commit/e5b928783d5c485637565eb07d2967922dfbf8d8

Resource:

patch

Hyperlink: https://github.com/nanocoai/nanoclaw/

Resource:

product

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References