PT-2026-69139

CVE-2026-19244

Published

2026-08-07

Updated

2026-10-23

Description by

CVSS 2.0

5.8

Medium

MetricsAV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0

Description Improper access controls exist within the MCP enabledTools Scope Handler component. The issue resides in the connect mcp servers() function located in the nanobot/agent/tools/mcp.py file. This flaw allows MCP resource and prompt wrappers to be registered outside the intended enabledTools scope, enabling a remote attacker to perform unauthorized manipulations.

Recommendations Upgrade to version 0.3.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-266: Incorrect Privilege Assignment

CWE-284: Improper Access Control

Related identifiers