CVE-2026-17434: NanoClaw Auth Bypass Vulnerability

CVE-2026-17434 Overview

CVE-2026-17434 is an improper authorization vulnerability in nanocoai NanoClaw versions up to 2.0.64. The flaw resides in the handleAddMcpServer function within src/modules/self-mod/request.ts, part of the add_mcp_server component. An attacker with low privileges can manipulate the function remotely to bypass authorization controls. A public exploit has been released, and the issue is tracked under CWE-266: Incorrect Privilege Assignment. The maintainers published a fix in commit e5b928783d5c485637565eb07d2967922dfbf8d8.

Critical Impact
Remote authenticated attackers can invoke handleAddMcpServer to perform actions beyond their intended authorization scope on affected NanoClaw instances.

Affected Products

nanocoai NanoClaw versions up to and including 2.0.64
Component: add_mcp_server
File: src/modules/self-mod/request.ts

Discovery Timeline

2026-07-26 - CVE-2026-17434 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-17434

Vulnerability Analysis

The vulnerability affects the handleAddMcpServer function, which manages Model Context Protocol (MCP) server registration in NanoClaw. The function fails to enforce proper authorization checks before executing privileged operations. An authenticated attacker with limited privileges can craft a request that triggers the function and gains access to actions reserved for higher-privileged roles.

Because the exploit vector is remote and requires only low privileges with no user interaction, the flaw is reachable in typical multi-user deployments. The confidentiality, integrity, and availability impacts are each rated low, meaning individual exploitation yields limited disruption but may serve as a foothold for further activity.

Root Cause

The root cause is an incorrect privilege assignment [CWE-266] in the MCP server registration flow. The handleAddMcpServer handler does not sufficiently validate whether the requesting principal is authorized to add or modify MCP server entries. This omission allows lower-privileged accounts to perform administrative-scope actions on the MCP configuration.

Attack Vector

An attacker authenticates to the NanoClaw application with a low-privilege account. The attacker then submits a request that invokes handleAddMcpServer with parameters that would normally require elevated authorization. Because the handler skips or improperly performs the authorization check, the request succeeds and the MCP server configuration is modified. A public exploit has been released, increasing the likelihood of opportunistic use.

text

// Security patch fixture - .claude/skills/add-discord/apply-fixtures.json
// Source: https://github.com/nanocoai/nanoclaw/commit/e5b928783d5c485637565eb07d2967922dfbf8d8
+{
+  "notes": "Conformance fixtures for scripts/skill-conformance.test.ts — shaped fake values only, never real credentials. The applications/@me stub answers the multi-field JSON capture (application_id/.id, public_key/.verify_key, owner_handle/.owner.id); the users/@me/channels stub answers the platform_id capture.",
+  "scenarios": [
+    {
+      "name": "bot-token",
+      "inputs": {
+        "bot_token": "MTA0fake.token.fake_fake-fake.fake0123456789abcdefghijklmnopqrstuvwxyz"
+      },
+      "exec": [
+        { "match": "oauth2/applications/@me", "stdout": "{\"id\":\"1234567890\",\"verify_key\":\"abcdef0123456789\",\"owner\":{\"id\":\"111222333444\"}}" },
+        { "match": "users/@me/channels", "stdout": "discord:@me:D0FAKE" }
+      ]
+    }
+  ]
+}

The patch introduces conformance fixtures that validate MCP approval payload handling. See the GitHub Commit Details for the complete change set.

Detection Methods for CVE-2026-17434

Indicators of Compromise

Unexpected invocations of the handleAddMcpServer endpoint from low-privileged user sessions
Unauthorized additions or modifications to the MCP server configuration in NanoClaw
HTTP requests to add_mcp_server originating from accounts without administrative roles

Detection Strategies

Audit application logs for calls to src/modules/self-mod/request.tshandleAddMcpServer correlated with user role
Compare snapshots of registered MCP servers against a known-good baseline to identify unauthorized additions
Alert on discrepancies between the acting user's role and the sensitivity of the invoked handler

Monitoring Recommendations

Enable verbose request logging for NanoClaw self-modification endpoints
Forward NanoClaw application logs to a centralized SIEM for role-based anomaly analytics
Monitor the GitHub Issue Tracker and GitHub Pull Request for updates and additional guidance

How to Mitigate CVE-2026-17434

Immediate Actions Required

Upgrade NanoClaw to a version that includes commit e5b928783d5c485637565eb07d2967922dfbf8d8
Review recent MCP server registrations and revert any unauthorized entries
Restrict network exposure of NanoClaw instances to trusted users while patching

Patch Information

The maintainers published a fix in commit e5b928783d5c485637565eb07d2967922dfbf8d8. Apply the patch by upgrading to a NanoClaw release later than 2.0.64 or by cherry-picking the commit into a local build. Additional context is available in the VulDB CVE Report and the GitHub Project Repository.

Workarounds

Limit NanoClaw accounts to trusted operators until the patch is deployed
Place an authenticating reverse proxy in front of NanoClaw to restrict access to the add_mcp_server route to administrative accounts
Disable the MCP self-modification feature in configuration where operationally acceptable

bash

# Update NanoClaw from the patched source tree
git clone https://github.com/nanocoai/nanoclaw.git
cd nanoclaw
git checkout e5b928783d5c485637565eb07d2967922dfbf8d8
# Rebuild and redeploy per your environment's process