EUVD-2026-54652
GHSA-qwp6-wxvx-2jc8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires high-privilege MCP server control or operator-level access; low C/I from unintended capability registration; no availability impact from scope bypass.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 0.3.0 is sufficient to fix this issue. The patch is named 4436. You should upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "Both reports describe the same root cause: MCP resource and prompt wrappers could be registered outside the intended enabledTools scope. The registration boundary was corrected".
AnalysisAI
MCP resource and prompt wrappers in HKUDS nanobot 0.2.0 and 0.2.1 bypass operator-defined enabledTools access restrictions, allowing MCP servers to register capabilities beyond the intended scope. Operators who configure a specific tool allowlist to restrict what an MCP server can contribute to a nanobot agent find that resources and prompts from that server are registered unconditionally, exposing capabilities that were explicitly intended to be blocked. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the operator has explicitly configured `enabledTools` for an MCP server connection with a non-wildcard value - either an empty list `[]` (deny-all) or a specific named list of tool names. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) characterizes this as medium severity with a public exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to nanobot v0.3.0, which resolves the issue via pull request #4436 (https://github.com/HKUDS/nanobot/pull/4436) and is available at https://github.com/HKUDS/nanobot/releases/tag/v0.3.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establ
Remote code execution in nanobot personal AI assistant (versions prior to 0.1.6) allows unauthenticated attackers to exe
Arbitrary file write in HKUDS Nanobot's WhatsApp bridge (versions 0.1.5.post3 and prior) allows remote unauthenticated a
Server-side request forgery in Nanobot (HKUDS) prior to 0.2.1 lets unauthenticated remote attackers exfiltrate Microsoft
OS command injection in HKUDS nanobot 0.2.0 and 0.2.1 allows a low-privileged remote attacker to bypass the configured s
Server-side request forgery in HKUDS nanobot up to 0.2.1 allows authenticated remote attackers to make the server issue
Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local l
Nanobot's Matrix channel media download handler exhausts process memory and bandwidth when authenticated room members su
Server-side request forgery in Nanobot's web_fetch tool prior to v0.2.1 allows authenticated remote attackers to probe a
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today