CVE-2026-17433

Name of the Vulnerable Software and Affected Versions ananocoai NanoClaw versions prior to 2.0.65

Description An improper authorization issue exists within the MCP Server Approval component, specifically affecting the createChatSdkBridge.setup() function located in the src/channels/chat-sdk-bridge.ts file. A local attacker can perform a manipulation to bypass authorization controls.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict local access to the createChatSdkBridge.setup() function.