CVE-2026-17433
Full vulnerability record from the local CVENow database.
Description
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
LOW
CVSS score
1.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-26 03:16:32.490000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-17433",
"sourceIdentifier": "[email protected]",
"published": "2026-07-26T03:16:32.490",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Una vulnerabilidad fue detectada en nanocoai NanoClaw hasta la versión 2.0.64. Esto afecta a la función createChatSdkBridge.setup del archivo src/channels/chat-sdk-bridge.ts del componente Aprobación del Servidor MCP. Realizar una manipulación resulta en una autorización indebida. El ataque necesita ser abordado localmente. El exploit ahora es público y puede ser utilizado. El proyecto fue informado del problema con antelación a través de un informe de incidencias, pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "nanocoai",
"product": "NanoClaw",
"cpes": [
"cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"MCP Server Approval"
],
"versions": [
{
"version": "2.0.0",
"status": "affected"
},
{
"version": "2.0.1",
"status": "affected"
},
{
"version": "2.0.2",
"status": "affected"
},
{
"version": "2.0.3",
"status": "affected"
},
{
"version": "2.0.4",
"status": "affected"
},
{
"version": "2.0.5",
"status": "affected"
},
{
"version": "2.0.6",
"status": "affected"
},
{
"version": "2.0.7",
"status": "affected"
},
{
"version": "2.0.8",
"status": "affected"
},
{
"version": "2.0.9",
"status": "affected"
},
{
"version": "2.0.10",
"status": "affected"
},
{
"version": "2.0.11",
"status": "affected"
},
{
"version": "2.0.12",
"status": "affected"
},
{
"version": "2.0.13",
"status": "affected"
},
{
"version": "2.0.14",
"status": "affected"
},
{
"version": "2.0.15",
"status": "affected"
},
{
"version": "2.0.16",
"status": "affected"
},
{
"version": "2.0.17",
"status": "affected"
},
{
"version": "2.0.18",
"status": "affected"
},
{
"version": "2.0.19",
"status": "affected"
},
{
"version": "2.0.20",
"status": "affected"
},
{
"version": "2.0.21",
"status": "affected"
},
{
"version": "2.0.22",
"status": "affected"
},
{
"version": "2.0.23",
"status": "affected"
},
{
"version": "2.0.24",
"status": "affected"
},
{
"version": "2.0.25",
"status": "affected"
},
{
"version": "2.0.26",
"status": "affected"
},
{
"version": "2.0.27",
"status": "affected"
},
{
"version": "2.0.28",
"status": "affected"
},
{
"version": "2.0.29",
"status": "affected"
},
{
"version": "2.0.30",
"status": "affected"
},
{
"version": "2.0.31",
"status": "affected"
},
{
"version": "2.0.32",
"status": "affected"
},
{
"version": "2.0.33",
"status": "affected"
},
{
"version": "2.0.34",
"status": "affected"
},
{
"version": "2.0.35",
"status": "affected"
},
{
"version": "2.0.36",
"status": "affected"
},
{
"version": "2.0.37",
"status": "affected"
},
{
"version": "2.0.38",
"status": "affected"
},
{
"version": "2.0.39",
"status": "affected"
},
{
"version": "2.0.40",
"status": "affected"
},
{
"version": "2.0.41",
"status": "affected"
},
{
"version": "2.0.42",
"status": "affected"
},
{
"version": "2.0.43",
"status": "affected"
},
{
"version": "2.0.44",
"status": "affected"
},
{
"version": "2.0.45",
"status": "affected"
},
{
"version": "2.0.46",
"status": "affected"
},
{
"version": "2.0.47",
"status": "affected"
},
{
"version": "2.0.48",
"status": "affected"
},
{
"version": "2.0.49",
"status": "affected"
},
{
"version": "2.0.50",
"status": "affected"
},
{
"version": "2.0.51",
"status": "affected"
},
{
"version": "2.0.52",
"status": "affected"
},
{
"version": "2.0.53",
"status": "affected"
},
{
"version": "2.0.54",
"status": "affected"
},
{
"version": "2.0.55",
"status": "affected"
},
{
"version": "2.0.56",
"status": "affected"
},
{
"version": "2.0.57",
"status": "affected"
},
{
"version": "2.0.58",
"status": "affected"
},
{
"version": "2.0.59",
"status": "affected"
},
{
"version": "2.0.60",
"status": "affected"
},
{
"version": "2.0.61",
"status": "affected"
},
{
"version": "2.0.62",
"status": "affected"
},
{
"version": "2.0.63",
"status": "affected"
},
{
"version": "2.0.64",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 1.9,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 4.3,
"accessVector": "LOCAL",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 3.1,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-27T17:25:34.136097Z",
"id": "CVE-2026-17433",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-285"
}
]
}
],
"references": [
{
"url": "https://github.com/nanocoai/nanoclaw/",
"source": "[email protected]"
},
{
"url": "https://github.com/nanocoai/nanoclaw/issues/2761",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-17433",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/862450",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/383074",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/383074/cti",
"source": "[email protected]"
}
]
}