CVE-2026-17433

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS v3 5.3 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 3.1 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/nanocoai/nanoclaw/
https://github.com/nanocoai/nanoclaw/issues/2761
https://vuldb.com/cve/CVE-2026-17433
https://vuldb.com/submit/862450
https://vuldb.com/vuln/383074
https://vuldb.com/vuln/383074/cti

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue detectada en nanocoai NanoClaw hasta la versión 2.0.64. Esto afecta a la función createChatSdkBridge.setup del archivo src/channels/chat-sdk-bridge.ts del componente Aprobación del Servidor MCP. Realizar una manipulación resulta en una autorización indebida. El ataque necesita ser abordado localmente. El exploit ahora es público y puede ser utilizado. El proyecto fue informado del problema con antelación a través de un informe de incidencias, pero aún no ha respondido.

Information

Published : 2026-07-26 03:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-17433

Mitre link : CVE-2026-17433

CVE.ORG link : CVE-2026-17433

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

CWE-285

Improper Authorization

{"id": "CVE-2026-17433", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17433", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T17:25:34.136097Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*"], "vendor": "nanocoai", "modules": ["MCP Server Approval"], "product": "NanoClaw", "versions": [{"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.0.2"}, {"status": "affected", "version": "2.0.3"}, {"status": "affected", "version": "2.0.4"}, {"status": "affected", "version": "2.0.5"}, {"status": "affected", "version": "2.0.6"}, {"status": "affected", "version": "2.0.7"}, {"status": "affected", "version": "2.0.8"}, {"status": "affected", "version": "2.0.9"}, {"status": "affected", "version": "2.0.10"}, {"status": "affected", "version": "2.0.11"}, {"status": "affected", "version": "2.0.12"}, {"status": "affected", "version": "2.0.13"}, {"status": "affected", "version": "2.0.14"}, {"status": "affected", "version": "2.0.15"}, {"status": "affected", "version": "2.0.16"}, {"status": "affected", "version": "2.0.17"}, {"status": "affected", "version": "2.0.18"}, {"status": "affected", "version": "2.0.19"}, {"status": "affected", "version": "2.0.20"}, {"status": "affected", "version": "2.0.21"}, {"status": "affected", "version": "2.0.22"}, {"status": "affected", "version": "2.0.23"}, {"status": "affected", "version": "2.0.24"}, {"status": "affected", "version": "2.0.25"}, {"status": "affected", "version": "2.0.26"}, {"status": "affected", "version": "2.0.27"}, {"status": "affected", "version": "2.0.28"}, {"status": "affected", "version": "2.0.29"}, {"status": "affected", "version": "2.0.30"}, {"status": "affected", "version": "2.0.31"}, {"status": "affected", "version": "2.0.32"}, {"status": "affected", "version": "2.0.33"}, {"status": "affected", "version": "2.0.34"}, {"status": "affected", "version": "2.0.35"}, {"status": "affected", "version": "2.0.36"}, {"status": "affected", "version": "2.0.37"}, {"status": "affected", "version": "2.0.38"}, {"status": "affected", "version": "2.0.39"}, {"status": "affected", "version": "2.0.40"}, {"status": "affected", "version": "2.0.41"}, {"status": "affected", "version": "2.0.42"}, {"status": "affected", "version": "2.0.43"}, {"status": "affected", "version": "2.0.44"}, {"status": "affected", "version": "2.0.45"}, {"status": "affected", "version": "2.0.46"}, {"status": "affected", "version": "2.0.47"}, {"status": "affected", "version": "2.0.48"}, {"status": "affected", "version": "2.0.49"}, {"status": "affected", "version": "2.0.50"}, {"status": "affected", "version": "2.0.51"}, {"status": "affected", "version": "2.0.52"}, {"status": "affected", "version": "2.0.53"}, {"status": "affected", "version": "2.0.54"}, {"status": "affected", "version": "2.0.55"}, {"status": "affected", "version": "2.0.56"}, {"status": "affected", "version": "2.0.57"}, {"status": "affected", "version": "2.0.58"}, {"status": "affected", "version": "2.0.59"}, {"status": "affected", "version": "2.0.60"}, {"status": "affected", "version": "2.0.61"}, {"status": "affected", "version": "2.0.62"}, {"status": "affected", "version": "2.0.63"}, {"status": "affected", "version": "2.0.64"}]}]}], "published": "2026-07-26T03:16:32.490", "references": [{"url": "https://github.com/nanocoai/nanoclaw/", "source": "cna@vuldb.com"}, {"url": "https://github.com/nanocoai/nanoclaw/issues/2761", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-17433", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/862450", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/383074", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/383074/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en nanocoai NanoClaw hasta la versi\u00f3n 2.0.64. Esto afecta a la funci\u00f3n createChatSdkBridge.setup del archivo src/channels/chat-sdk-bridge.ts del componente Aprobaci\u00f3n del Servidor MCP. Realizar una manipulaci\u00f3n resulta en una autorizaci\u00f3n indebida. El ataque necesita ser abordado localmente. El exploit ahora es p\u00fablico y puede ser utilizado. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "cna@vuldb.com"}