anonhaven

CVE-2026-19244

MEDIUM CVSS 4.0: 2.0 EPSS 0.27%
Updated Aug 13, 2026
Hkuds
Parameter Value
CVSS 2.0 (MEDIUM)
Type CWE-284 (Improper Access Control), CWE-266 (Incorrect Privilege Assignment)
Vendor Hkuds
Public PoC No

A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls.

The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 0.3.0 is sufficient to fix this issue.

The patch is named 4436. You should upgrade the affected component. Multiple issues were reported to the project.

They reacted with a high level of professionalism and kindness: "Both reports describe the same root cause: MCP resource and prompt wrappers could be registered outside the intended enabledTools scope. The registration boundary was corrected".

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-284 Improper Access Control
CWE-266 Incorrect Privilege Assignment

Vulnerable Products

hkuds:nanobot

References 10

https://vuldb.com/vuln/386998
VDB-386998 | HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control
https://vuldb.com/vuln/386998/cti
VDB-386998 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/cve/CVE-2026-19244
CVE-2026-19244 | CVE Analysis and Report
https://vuldb.com/submit/865116
Submit #865116 | HKUDS nanobot 0.2.1 Improper Access Control in MCP Capability Registration (CWE-284)
https://vuldb.com/submit/865118
Submit #865118 | HKUDS nanobot 0.2.1 Improper Access Control in MCP Wrapper Exposure (CWE-284) (Duplicate)
https://github.com/HKUDS/nanobot/issues/4435
NVD
https://gist.github.com/YLChen-007/3de5f50d167a878f7530f57ed018d508
NVD
https://github.com/HKUDS/nanobot/pull/4436
NVD
https://github.com/HKUDS/nanobot/releases/tag/v0.3.0
NVD
https://github.com/HKUDS/nanobot/
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-19246

Hkuds

2.1

CVE-2026-19245

Hkuds

1.9

CVE-2026-19243

Hkuds

2.1

CVE-2026-32847

Hkuds

8.7

CVE-2026-7551

Hkuds

8.7