NanoClaw CVE-2026-19005

Exploitation requires a valid NanoClaw account with at least low-privilege access (PR:L per CVSS 4.0 vector) - unauthenticated external attackers cannot exploit this directly. The vulnerability is specifically triggered through the Child-Agent Creation workflow via the handleCreateAgent function; the attacker must be able to invoke this endpoint. No victim interaction is required (UI:N), and the attack is conducted remotely over the network (AV:N) with low complexity (AC:L) and no specific attack preconditions (AT:N). Exploitation is bounded by the absence of a scope change (SC:N/SI:N/SA:N), meaning the attacker's elevated impact is confined to the NanoClaw system itself and does not directly enable lateral movement to other infrastructure. The primary limiting factor is the authentication requirement - attackers must first obtain or possess valid platform credentials before exploiting the privilege escalation.

The CVSS 4.0 base score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L reflects moderate, bounded impact - confidentiality, integrity, and availability impacts are each low and confined to the vulnerable system (SC:N/SI:N/SA:N). The E:P (Proof of Concept) exploit maturity modifier confirms a public POC is incorporated into the vector and lowers the barrier to exploitation. This is not a KEV-listed vulnerability, meaning CISA has not confirmed active in-the-wild exploitation at time of analysis. EPSS data was not provided in available intelligence, so probabilistic exploitation likelihood cannot be quantified here. The key risk driver is the combination of: a public POC, no vendor patch, low complexity, and no user interaction required. However, PR:L bounds opportunistic mass exploitation - an attacker must first possess valid credentials. For organizations running NanoClaw, this represents a meaningful lateral privilege escalation risk from insider threats or compromised low-privilege accounts, rather than a perimeter-breach vector.

An attacker with a valid low-privilege NanoClaw account sends a crafted HTTP request to the agent-to-agent creation endpoint, manipulating parameters processed by handleCreateAgent to assign elevated permissions to a newly created child agent beyond what the caller is authorized to grant. A public POC exists at GitHub issue #2807, providing a concrete template for exploitation. The attacker's spawned child agent can then perform privileged actions within the NanoClaw platform on behalf of the attacker, effectively escalating their operational capabilities.