CVE-2026-56692
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
NanoClaw before version 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only isSafeAttachmentName, which allows malicious agents to disclose arbitrary host files.
Risk Assessment
Organizations may be exposed to sensitive data leaks from the host, potentially leading to serious security breaches and loss of customer trust.
Recommendation
It is recommended to update NanoClaw to version 2.1.17 or later to mitigate this vulnerability and implement additional security measures to prevent unauthorized file access.
Other vulnerabilities in NanoClaw
See all- CVE-2026-56694Medium
NanoClaw before version 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups.
- CVE-2026-56693Medium
NanoClaw before version 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations, escalating beyond their intended confinement boundary.
- CVE-2026-56402Medium
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation.
- CVE-2026-19005Medium
A vulnerability in nanocoai NanoClaw up to 2.0.64 affects the function handleCreateAgent in src/modules/agent-to-agent/create-agent.ts, causing improper privilege management. Remote exploitation is possible and exploit is public.
- CVE-2026-18991High
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64, affecting an unknown part of the file container/agent-runner/src/mcp-tools/core.ts in the send_file component. Manipulation leads to path traversal, allowing remote attack. The exploit has been publicly disclosed and may be used.
- CVE-2026-17434Medium
In nanocoai NanoClaw up to version 2.0.64, a vulnerability was found in the handleAddMcpServer function of the file src/modules/self-mod/request.ts in the add_mcp_server component. Manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been published. A patch is available with ID e5b928783d5c485637565eb07d2967922dfbf8d8.
- CVE-2026-17433Medium
In nanocoai NanoClaw up to version 2.0.64, a vulnerability was detected in the createChatSdkBridge.setup function of the file src/channels/chat-sdk-bridge.ts in the MCP Server Approval component. Manipulation results in improper authorization. The attack requires local access. The exploit is public. The project was informed but has not responded.
Original NVD description (English source)
NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only isSafeAttachmentName before copying with fs.copyFileSync, which follows symlinks without containment checks, allowing malicious agents to disclose arbitrary host files.