CVE-2026-17433: NanoClaw Auth Bypass Vulnerability

CVE-2026-17433 Overview

CVE-2026-17433 is an improper authorization vulnerability [CWE-266] in nanocoai NanoClaw through version 2.0.64. The flaw resides in the createChatSdkBridge.setup function within src/channels/chat-sdk-bridge.ts, part of the MCP Server Approval component. A local attacker with low privileges can manipulate the approval flow to bypass authorization controls. The exploit code is publicly disclosed. The project maintainers were notified through an issue report but have not responded at the time of publication.

Critical Impact
A local attacker can bypass MCP Server Approval checks in NanoClaw to gain unauthorized access to protected functionality with limited impact on confidentiality, integrity, and availability.

Affected Products

nanocoai NanoClaw versions up to and including 2.0.64
Component: MCP Server Approval
Affected function: createChatSdkBridge.setup in src/channels/chat-sdk-bridge.ts

Discovery Timeline

2026-07-26 - CVE CVE-2026-17433 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-17433

Vulnerability Analysis

The vulnerability affects the MCP (Model Context Protocol) Server Approval component of NanoClaw, an AI-related project maintained by nanocoai. The createChatSdkBridge.setup function in src/channels/chat-sdk-bridge.ts does not correctly enforce authorization controls when handling approval decisions for MCP server operations.

An authenticated local user can manipulate the bridge setup flow to invoke actions that should require higher approval or a separate authorization decision. The impact is limited to the local host and results in low confidentiality, integrity, and availability effects. This category of weakness is classified as improper authorization [CWE-266], reflecting an incorrect trust boundary in the approval workflow.

Root Cause

The root cause is missing or insufficient authorization checks in the createChatSdkBridge.setup code path. The MCP Server Approval component relies on this bridge to gate privileged actions, but the current implementation permits a low-privileged local caller to influence approval state without re-validating the caller's authority.

Attack Vector

Exploitation requires local access with at least low-privileged credentials on the host running NanoClaw. No user interaction is required. Once local access is established, the attacker manipulates the chat SDK bridge setup to bypass the approval component. Public exploit information is available through VulDB, increasing the likelihood of opportunistic abuse in vulnerable deployments.

No verified proof-of-concept code has been published in a form suitable for reproduction here. See the GitHub Issue #2761 on Nanoclaw and the VulDB CVE-2026-17433 advisory for further technical detail.

Detection Methods for CVE-2026-17433

Indicators of Compromise

Unexpected invocations of createChatSdkBridge.setup from non-standard local processes or user contexts.
MCP Server Approval events that complete without a corresponding user-approval interaction in application logs.
Local user accounts performing MCP-related actions outside their normal operational patterns.

Detection Strategies

Enable verbose logging on the NanoClaw MCP Server Approval component and alert on approval decisions that lack a preceding approval prompt event.
Monitor process execution and file access on src/channels/chat-sdk-bridge.ts runtime artifacts to identify tampering or unauthorized invocation.
Correlate local authentication events with NanoClaw approval events to identify low-privileged accounts triggering privileged bridge operations.

Monitoring Recommendations

Track approval decisions per user and flag statistical anomalies against baseline behavior.
Retain NanoClaw application logs centrally for at least 90 days to support post-incident review.
Alert on any modification of NanoClaw binaries or JavaScript/TypeScript bundle files on production hosts.

How to Mitigate CVE-2026-17433

Immediate Actions Required

Restrict local access to hosts running NanoClaw to trusted administrators only.
Remove or disable NanoClaw on multi-user systems until a patched release is available.
Review local account privileges and remove unnecessary accounts that could exercise the MCP bridge.

Patch Information

At the time of publication, no vendor patch has been released. The maintainers were informed through GitHub Issue #2761 on Nanoclaw but have not responded. Track the GitHub Repository for Nanoclaw for updates and apply a fixed release as soon as one is published above version 2.0.64.

Workarounds

Run NanoClaw under a dedicated low-privileged service account isolated from other users on the host.
Apply operating-system-level access controls to restrict execution of NanoClaw to a defined administrator group.
Disable the MCP Server Approval feature or the chat SDK bridge integration in configuration if it is not required for operational use.

bash

# Configuration example: restrict NanoClaw execution to a trusted group
sudo groupadd nanoclaw-admins
sudo chown root:nanoclaw-admins /opt/nanoclaw/bin/nanoclaw
sudo chmod 750 /opt/nanoclaw/bin/nanoclaw

# Optional: prevent other local users from reading the bridge source
sudo chmod 640 /opt/nanoclaw/src/channels/chat-sdk-bridge.ts