NanoClaw MCP Server Approval Improper Authorization
First seen Jul 26, 2026 · Updated Jul 26, 2026 · CVSS 5.3
A vulnerability in NanoClaw's MCP Server Approval component allows a local attacker to bypass authorization checks in the createChatSdkBridge.setup function, potentially approving or manipulating MCP server connections without proper consent. The flaw requires local access and has a public exploit available, but the vendor has not yet responded to the disclosure. Severity is moderate due to the local attack vector constraint, though the improper authorization could undermine trust in MCP server approval workflows.
Technical Analysis
The vulnerability resides in the setup function of the chat-sdk-bridge.ts file, part of NanoClaw's MCP Server Approval mechanism, which is responsible for gating which MCP servers a client agent is allowed to trust and connect to. Improper authorization logic in this function means an attacker with local access could manipulate the approval flow to bypass user consent, potentially granting an unapproved or malicious MCP server access to the agent's tool-calling capabilities. This crosses the human-interface and protocol boundary: the approval step is meant to be a human-in-the-loop control preventing rogue MCP servers from being wired into the agent, and bypassing it could enable subsequent tool-poisoning or data exfiltration via a now-trusted malicious server. The local-only attack vector limits remote exploitation, but on shared or multi-user systems it significantly lowers the bar for privilege escalation into agent tool access.
Affected Systems
NanoClaw (nanocoai); protocols: MCP
Detection Signatures
- Unexpected MCP server approvals without corresponding user interaction logs
- Anomalous invocations of createChatSdkBridge.setup outside normal UI approval flow
- MCP server connections established with mismatched or missing approval timestamps
- Local process manipulation of chat-sdk-bridge.ts state prior to server connection
Remediation Steps
- 1
Upgrade or patch NanoClaw
Monitor the nanocoai project for a patched release beyond 2.0.64; apply as soon as available since the vendor has not yet responded to the disclosure.
- 2
Restrict local access
Limit local system access to hosts running NanoClaw to trusted users only, reducing exposure to this locally-exploitable authorization bypass.
- 3
Audit MCP server approvals
Review logs of MCP server approval events for anomalies or approvals lacking corresponding user confirmation.
- 4
Implement compensating controls
Add independent authorization checks or allowlists for MCP server connections outside the vulnerable approval component until a fix is released.
- 5
Track exploit availability
Since a public exploit exists, monitor threat intel feeds for active exploitation attempts against NanoClaw deployments.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.