CVE-2026-56694
MediumCVSS 5.4Summary
NanoClaw before version 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups.
Risk Assessment
Scoped admins can submit forged or stale connect callback values, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.
Recommendation
It is recommended to update NanoClaw to version 2.1.0 or later and implement additional privilege verification mechanisms in the channel registration approval process.
Other vulnerabilities in NanoClaw
See all- CVE-2026-56693Medium
NanoClaw before version 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations, escalating beyond their intended confinement boundary.
- CVE-2026-56402Medium
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation.
- CVE-2026-19005Medium
A vulnerability in nanocoai NanoClaw up to 2.0.64 affects the function handleCreateAgent in src/modules/agent-to-agent/create-agent.ts, causing improper privilege management. Remote exploitation is possible and exploit is public.
- CVE-2026-18991High
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64, affecting an unknown part of the file container/agent-runner/src/mcp-tools/core.ts in the send_file component. Manipulation leads to path traversal, allowing remote attack. The exploit has been publicly disclosed and may be used.
- CVE-2026-17434Medium
In nanocoai NanoClaw up to version 2.0.64, a vulnerability was found in the handleAddMcpServer function of the file src/modules/self-mod/request.ts in the add_mcp_server component. Manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been published. A patch is available with ID e5b928783d5c485637565eb07d2967922dfbf8d8.
- CVE-2026-17433Medium
In nanocoai NanoClaw up to version 2.0.64, a vulnerability was detected in the createChatSdkBridge.setup function of the file src/channels/chat-sdk-bridge.ts in the MCP Server Approval component. Manipulation results in improper authorization. The attack requires local access. The exploit is public. The project was informed but has not responded.
- CVE-2026-56692Medium
NanoClaw before version 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only isSafeAttachmentName, which allows malicious agents to disclose arbitrary host files.
Original NVD description (English source)
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.