EUVD-2026-38463
GHSA-mhq9-hcw8-22mj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable callback (AV:N), low attacker effort once a questionId is known (AC:L), requires ability to send a callback payload to the bot (PR:L), no user interaction, integrity-only impact via unauthorized approval dispatch.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation.
AnalysisAI
Privilege escalation in NanoClaw before 2.1.17 lets remote attackers with a valid questionId approve or reject privileged actions (such as package installation) by submitting crafted approval response payloads. The handleApprovalsResponse function dispatches sensitive handlers without verifying the responder holds an owner/admin role, turning approval callbacks into an authorization bypass. Publicly available exploit code exists via the upstream patch diff, but no active exploitation is currently confirmed.
Technical ContextAI
NanoClaw (cpe:2.3:a:nanocoai:nanoclaw) is an agent-orchestration tool that delivers approval cards to administrators over messaging platforms like Telegram and processes their button responses through handleApprovalsResponse in src/modules/approvals/response-handler.ts. The root cause is CWE-862 (Missing Authorization): the handler treats inbound callbacks as trusted simply because they carry a known questionId, never cross-referencing the responding userId against the permissions database (user-roles with owner/admin). Approval cards may be DM-delivered to admins, but the callback payload itself is untrusted input, and the missing role check allows any party who can craft or replay the callback to dispatch privileged actions like install_packages.
RemediationAI
Upgrade NanoClaw to 2.1.17 or later, which incorporates the upstream fix from commit 6227bd1a5b016fb1eb76411bb6681b4c924a51a0 (PR https://github.com/nanocoai/nanoclaw/pull/2478) that validates the responder's role against the permissions database before dispatching approval handlers. Until upgrade, restrict the messaging integration (e.g. Telegram bot) to a tightly controlled channel or DM with only trusted admin accounts, disable or avoid registering sensitive approval handlers such as install_packages, and audit pending approvals and recent privileged actions for unexpected approvers; these controls reduce exposure but do not fully close the bypass because the bug is in the server-side dispatch, not the delivery channel. Refer to the VulnCheck advisory at https://www.vulncheck.com/advisories/nanoclaw-privilege-escalation-via-unverified-approval-response-handler for further detail.
Path traversal in NanoClaw's container filesystem boundary allows compromised containers or prompt-injected agents to es
Symlink following in NanoClaw's agent-to-agent file forwarding exposes arbitrary host-readable files to container-contro
Privilege escalation in NanoClaw before 2.1.17 allows confined agent containers to bypass their architectural confinemen
Improper authorization in nanocoai NanoClaw's add_mcp_server endpoint allows authenticated attackers with low privileges
Improper privilege management in NanoClaw (versions up to 2.0.64) allows authenticated remote attackers to abuse the `ha
We need answer JSON only. Need synthesize. Let's parse input. CVE-2026-90807. Product nanocoai NanoClaw up to 2.1.17. F
Improper authorization in NanoClaw's MCP Server Approval component allows local attackers to bypass security controls by
Privilege escalation in NanoClaw before 2.1.0 lets scoped admins cross agent-group authorization boundaries by submittin
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today