Description

A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 0.3.0 is sufficient to fix this issue. The patch is named 4436. You should upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "Both reports describe the same root cause: MCP resource and prompt wrappers could be registered outside the intended enabledTools scope. The registration boundary was corrected".

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-07T21:17:27.470Z",
  "pubdate": "2026-08-07T21:17:27.470Z",
  "executiveSummary": "An improper access control vulnerability has been identified in HKUDS nanobot up to version 0.2.1, specifically residing within the MCP enabledTools Scope Handler component. The flaw stems from improper boundary enforcement during the registration of Model Context Protocol (MCP) resource and prompt wrappers, which allows them to be registered outside of the intended enabledTools scope. An unauthenticated remote attacker can exploit this security shortcoming to bypass intended authorization scopes and execute unauthorized actions. Successful exploitation compromises the integrity and authorization boundaries of the application, potentially exposing sensitive data or unauthorized tool execution paths. The risk implications are severe due to the public availability of the exploit. Remediation requires upgrading the affected software component to version 0.3.0 or applying the official patch identified as 4436, which corrects the registration boundary enforcement logic.",
  "technicalDetails": "The vulnerability resides in the connect_mcp_servers function located within the nanobot/agent/tools/mcp.py file of the HKUDS nanobot component. Analysis indicates that the root cause involves flawed access control logic in the MCP enabledTools Scope Handler. Specifically, the application fails to adequately validate and restrict the registration boundaries for Model Context Protocol (MCP) resource and prompt wrappers. Consequently, wrappers that should strictly operate within a designated enabledTools scope can be registered and invoked outside of these intended security perimeters.\nThe attack vector is remote, allowing an external threat actor to interact with the vulnerable system over the network. The vulnerability does not inherently require complex authentication or elevated privileges, provided the target endpoint exposes the vulnerable MCP connection interface to the network. During an attack flow, the adversary crafts malicious or out-of-scope MCP resource and prompt registrations designed to bypass the intended security boundaries enforced by the enabledTools scope. Because the connect_mcp_servers function improperly processes these inputs without adequate boundary checks, the unauthorized wrappers are successfully registered within the runtime environment.\nPost-exploitation impact includes the potential execution of unauthorized functionalities, unauthorized access to system resources, and circumvention of the security isolation provided by the enabledTools scope. The flaw affects all HKUDS nanobot deployments utilizing versions up to and including 0.2.1. The underlying logic defect was formally addressed by the project maintainers, who corrected the registration boundary checks to ensure that MCP resources and prompts are strictly validated against the authorized scope during the connection phase."
}