NanoClaw CVE-2026-56402

Attacker must be able to deliver an approval-response callback to NanoClaw's messaging integration (e.g. a Telegram callback or equivalent webhook) and must possess a valid, currently-pending questionId for a sensitive approval such as install_packages. No admin role, no user interaction by a legitimate approver, and no special configuration are required - the vulnerable code path executes against the default approval pipeline on any NanoClaw instance before 2.1.17 that has registered sensitive approval handlers. Practical limits: the questionId is per-approval and only valid while the approval is pending, so the attacker needs either visibility into approval IDs or the ability to enumerate/guess them within that window.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1 and accurately reflects a low-privilege, network-reachable authorization bypass with high integrity impact and no confidentiality or availability loss - consistent with an attacker hijacking approval semantics rather than reading data. PR:L is appropriate because the attacker must be able to deliver a callback payload to the bot (typically a messaging account interacting with the integration), but no admin role is required. Exploitation requires knowledge of a valid questionId, which lowers practical risk somewhat (timing-bound, per-approval token), though IDs may be guessable or observable depending on transport. No KEV listing, no EPSS provided, and no public weaponized exploit beyond the fix commit; the regression tests in PR #2478 essentially document the exploitation pattern, so weaponization is trivial.

An attacker who learns or guesses a pending approval's questionId - for example, by observing an admin DM, intercepting a webhook, or replaying a leaked callback - submits a crafted approval response payload with value 'approve' and an arbitrary userId. The handler accepts it because role validation is missing, executing the privileged action such as installing attacker-chosen npm packages into the agent's container. The PR's regression tests demonstrate the exact payload shape, so publicly available exploit code exists.