Description
A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 0.3.0 is sufficient to fix this issue. The patch is named 4436. You should upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "Both reports describe the same root cause: MCP resource and prompt wrappers could be registered outside the intended enabledTools scope. The registration boundary was corrected".
Published: 2026-08-07
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A bug in HKUDS nanobot allows remote attackers to manipulate the connect_mcp_servers function in the MCP enabledTools Scope Handler, causing improper access control that lets them register MCP resources outside the intended scope. This flaw can be exploited remotely and an exploit is publicly available, giving attackers the ability to gain unauthorized access to the MCP subsystem.

Affected Systems

All releases of HKUDS nanobot through version 0.2.1 are affected. The issue is fixed in 0.3.0, which developers recommend upgrading to. The vulnerability resides in nanobot/agent/tools/mcp.py of the MCP enabledTools component.

Risk and Exploitability

The CVSS score is 5.1, indicating moderate impact. Though the EPSS metric is unavailable, the public nature of the exploit and the remote attack vector increase the risk to environments that expose the MCP endpoint. The vulnerability is not listed in the CISA KEV catalog, but the lack of an EPSS score does not absolve the need for remediation.

Generated by OpenCVE AI on August 7, 2026 at 21:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade HKUDS nanobot to version 0.3.0, which patches the connect_mcp_servers function.
  • Reconfigure nanobot to disable or restrict MCP enabledTools usage if that functionality is not required, limiting the attack surface.
  • Apply firewall or network segmentation rules to restrict external access to the MCP endpoint, preventing unauthorized connections until the patch is applied.

Generated by OpenCVE AI on August 7, 2026 at 21:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 0.3.0 is sufficient to fix this issue. The patch is named 4436. You should upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "Both reports describe the same root cause: MCP resource and prompt wrappers could be registered outside the intended enabledTools scope. The registration boundary was corrected".
Title HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control
First Time appeared Nanobot
Nanobot nanobot
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:*:*:*
Vendors & Products Nanobot
Nanobot nanobot
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nanobot Nanobot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-07T21:01:39.377Z

Reserved: 2026-08-07T12:07:04.739Z

Link: CVE-2026-19244

cve-icon Vulnrichment

Updated: 2026-08-07T20:49:52.235Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T22:30:03Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control