PT-2026-64794 · Nanocoai · Nanoclaw
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
ananocoai NanoClaw versions prior to 2.0.65
Description
A flaw in the
add mcp server component allows for improper authorization via remote manipulation. The issue resides within the handleAddMcpServer() function located in the src/modules/self-mod/request.ts file.Recommendations
Apply patch e5b928783d5c485637565eb07d2967922dfbf8d8 to remediate the issue.
As a temporary workaround, restrict access to the
handleAddMcpServer() function until the patch is applied.Exploit
Fix
Improper Authorization
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nanoclaw