cveboard RSS feed

CVE-2026-17434

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

NanoClaw

Vendor
nanocoai
Product
NanoClaw
Platforms
Unknown
Default status
Unknown
NanoClaw · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
2.0.0affectedUnavailableUnavailableUnavailableNone listed
2.0.1affectedUnavailableUnavailableUnavailableNone listed
2.0.2affectedUnavailableUnavailableUnavailableNone listed
2.0.3affectedUnavailableUnavailableUnavailableNone listed
2.0.4affectedUnavailableUnavailableUnavailableNone listed
2.0.5affectedUnavailableUnavailableUnavailableNone listed
2.0.6affectedUnavailableUnavailableUnavailableNone listed
2.0.7affectedUnavailableUnavailableUnavailableNone listed
2.0.8affectedUnavailableUnavailableUnavailableNone listed
2.0.9affectedUnavailableUnavailableUnavailableNone listed
2.0.10affectedUnavailableUnavailableUnavailableNone listed
2.0.11affectedUnavailableUnavailableUnavailableNone listed
2.0.12affectedUnavailableUnavailableUnavailableNone listed
2.0.13affectedUnavailableUnavailableUnavailableNone listed
2.0.14affectedUnavailableUnavailableUnavailableNone listed
2.0.15affectedUnavailableUnavailableUnavailableNone listed
2.0.16affectedUnavailableUnavailableUnavailableNone listed
2.0.17affectedUnavailableUnavailableUnavailableNone listed
2.0.18affectedUnavailableUnavailableUnavailableNone listed
2.0.19affectedUnavailableUnavailableUnavailableNone listed
2.0.20affectedUnavailableUnavailableUnavailableNone listed
2.0.21affectedUnavailableUnavailableUnavailableNone listed
2.0.22affectedUnavailableUnavailableUnavailableNone listed
2.0.23affectedUnavailableUnavailableUnavailableNone listed
2.0.24affectedUnavailableUnavailableUnavailableNone listed
2.0.25affectedUnavailableUnavailableUnavailableNone listed
2.0.26affectedUnavailableUnavailableUnavailableNone listed
2.0.27affectedUnavailableUnavailableUnavailableNone listed
2.0.28affectedUnavailableUnavailableUnavailableNone listed
2.0.29affectedUnavailableUnavailableUnavailableNone listed
2.0.30affectedUnavailableUnavailableUnavailableNone listed
2.0.31affectedUnavailableUnavailableUnavailableNone listed
2.0.32affectedUnavailableUnavailableUnavailableNone listed
2.0.33affectedUnavailableUnavailableUnavailableNone listed
2.0.34affectedUnavailableUnavailableUnavailableNone listed
2.0.35affectedUnavailableUnavailableUnavailableNone listed
2.0.36affectedUnavailableUnavailableUnavailableNone listed
2.0.37affectedUnavailableUnavailableUnavailableNone listed
2.0.38affectedUnavailableUnavailableUnavailableNone listed
2.0.39affectedUnavailableUnavailableUnavailableNone listed
2.0.40affectedUnavailableUnavailableUnavailableNone listed
2.0.41affectedUnavailableUnavailableUnavailableNone listed
2.0.42affectedUnavailableUnavailableUnavailableNone listed
2.0.43affectedUnavailableUnavailableUnavailableNone listed
2.0.44affectedUnavailableUnavailableUnavailableNone listed
2.0.45affectedUnavailableUnavailableUnavailableNone listed
2.0.46affectedUnavailableUnavailableUnavailableNone listed
2.0.47affectedUnavailableUnavailableUnavailableNone listed
2.0.48affectedUnavailableUnavailableUnavailableNone listed
2.0.49affectedUnavailableUnavailableUnavailableNone listed
2.0.50affectedUnavailableUnavailableUnavailableNone listed
2.0.51affectedUnavailableUnavailableUnavailableNone listed
2.0.52affectedUnavailableUnavailableUnavailableNone listed
2.0.53affectedUnavailableUnavailableUnavailableNone listed
2.0.54affectedUnavailableUnavailableUnavailableNone listed
2.0.55affectedUnavailableUnavailableUnavailableNone listed
2.0.56affectedUnavailableUnavailableUnavailableNone listed
2.0.57affectedUnavailableUnavailableUnavailableNone listed
2.0.58affectedUnavailableUnavailableUnavailableNone listed
2.0.59affectedUnavailableUnavailableUnavailableNone listed
2.0.60affectedUnavailableUnavailableUnavailableNone listed
2.0.61affectedUnavailableUnavailableUnavailableNone listed
2.0.62affectedUnavailableUnavailableUnavailableNone listed
2.0.63affectedUnavailableUnavailableUnavailableNone listed
2.0.64affectedUnavailableUnavailableUnavailableNone listed