EUVD-2026-38465
GHSA-7pvg-qfjr-jg4r
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Confined container execution (PR:L, AV:L) escapes to unauthorized host central-DB writes (S:C, I:H); no confidentiality or availability impact observed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations, escalating beyond their intended confinement boundary.
AnalysisAI
Privilege escalation in NanoClaw before 2.1.17 allows confined agent containers to bypass their architectural confinement boundary by invoking the create_agent delivery-action handler without host-side authorization. The handler performed privileged central-database writes - creating agent groups, container configurations, and destinations - gated only by a container-side MCP tool check that, being inside the untrusted container, is trivially bypassed by writing outbound system rows directly. No public exploit identified at time of analysis; a vendor patch is available and the fix is documented in a public GitHub commit.
Technical ContextAI
NanoClaw (CPE: cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*) is an AI agent orchestration platform that exposes MCP (Model Context Protocol) tools to containerized agent runtimes. Agent containers are assigned a CLI scope - 'global' for trusted owner groups and 'group' for confined agents - intended to limit what privileged operations they can perform. CWE-602 (Client-Side Enforcement of Server-Side Security) precisely describes the root cause: the only authorization gate for create_agent lived inside the container itself (the untrusted component), meaning a confined container could bypass it by crafting the outbound system row and writing it directly to the central database without the host ever checking the caller's scope. The fix in PR #2720 (commit ac37ecbfd6b9d14fdfa1598a6412a8ffdbeaef45) moves authorization to the host side, requiring 'global' scope for direct creation and routing all other scopes - including 'group', 'disabled', and missing config - through an admin approval flow that fails closed.
RemediationAI
Upgrade NanoClaw to version 2.1.17 or later, which enforces host-side authorization for the create_agent handler based on CLI scope. Note that the fix version 2.1.17 is stated in the CVE description; upstream fix availability is confirmed via GitHub commit ac37ecbfd6b9d14fdfa1598a6412a8ffdbeaef45 and PR #2720 (https://github.com/nanocoai/nanoclaw/pull/2720), but a formally tagged patched release has not been independently verified beyond the CVE description text. For deployments unable to patch immediately, operators should disable the create_agent MCP tool exposure for all confined agent containers - this eliminates the attack surface at the cost of losing sub-agent creation capability for those containers. As a detection compensating control, monitor central-database writes for unexpected agent group or container configuration creation events originating from containers with non-'global' scope. The VulnCheck advisory at https://www.vulncheck.com/advisories/nanoclaw-privilege-escalation-via-unauthorized-create-agent-system-action provides additional remediation context.
Path traversal in NanoClaw's container filesystem boundary allows compromised containers or prompt-injected agents to es
Privilege escalation in NanoClaw before 2.1.17 lets remote attackers with a valid questionId approve or reject privilege
Symlink following in NanoClaw's agent-to-agent file forwarding exposes arbitrary host-readable files to container-contro
Link-following (symlink) handling in NanoClaw's agent-to-agent attachment forwarding lets an authenticated, low-privileg
Improper authorization in nanocoai NanoClaw's add_mcp_server endpoint allows authenticated attackers with low privileges
Improper privilege management in NanoClaw (versions up to 2.0.64) allows authenticated remote attackers to abuse the `ha
Improper authorization in NanoClaw's MCP Server Approval component allows local attackers to bypass security controls by
Privilege escalation in NanoClaw before 2.1.0 lets scoped admins cross agent-group authorization boundaries by submittin
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today