AI 代理安全
NanoClaw MCP Approval Cards Hid Execution Parameters, Allowing Agents to Turn One-Time Consent into Persistent Execution Settings
The newly registered CVE-2026-17434 identifies an authorization gap in NanoClaw versions before 2.0.64: the MCP server approval card shown to administrators did not fully display the parameters and environment variables that would actually be applied. The fix now presents the complete payload, masks secret values, and limits input sizes, but affected deployments must still verify their versions and existing configurations.
NanoClaw isolates agents in containers and requires administrators to approve agent-submitted `add_mcp_server` self-modification requests. However, the newly disclosed CVE-2026-17434 shows that this human gate was once not bound to the configuration that was actually executed. Older approval cards displayed only the MCP server name and command. Although the `args` and `env` submitted by the agent were not shown, the host still saved them to the database and later wrote them into the agent’s `container.json`.
This allowed an agent compromised through prompt injection or otherwise taken over to propose an apparently harmless `node` server while using hidden arguments to add a `-e` program, or using `NODE_OPTIONS` to preload a local file. The attack still required an administrator to click approve, so it was not unauthenticated remote code execution. However, what the approver consented to on screen differed from what actually took effect, preventing human confirmation from serving as a reliable security boundary and allowing a single approval to leave behind persistent execution settings.
The upstream fix makes the card display the name, command, arguments, and environment variables field by field. It converts newlines, bidirectional text, and zero-width characters into visible escape sequences, while showing only the length and SHA-256 fingerprint of values suspected to contain secrets. The software also limits requests to 32 arguments, 32 environment variables, a 16 KB payload, and 1,500 bytes of card content to prevent messaging platforms from truncating trailing fields. If sending the card fails, the pending approval record is deleted.
In addition to upgrading, engineering teams should audit the command lines and environment variables in existing MCP configurations and incorporate verification that “the payload hash seen by the human equals the payload hash actually executed” into agent approval workflows. CVE databases classify the issue as medium severity, while the project issue uses a higher self-assessed score. Public information has not yet established that the vulnerability has been exploited in real-world attacks, and version mappings should be confirmed against subsequent vendor security advisories.