NanoClaw CVE-2026-56694

Exploitation requires an authenticated account holding the 'admin' role scoped to at least one agent group in a NanoClaw deployment running a version prior to 2.1.0 (CVSS PR:L confirmed). The attacker must be able to trigger or participate in a channel-registration approval flow - specifically, they must receive or intercept the interactive callback prompt for an unknown messaging channel. The forged callback value (connect:ag-X) must reference a valid agent group ID in the target system; knowledge of target group IDs may be obtainable through the approval UI itself, which pre-fix presented all groups without filtering. Unauthenticated users and non-admin users cannot exploit this flaw. Deployments where scoped admin accounts are restricted to fully trusted operators, or where no channel-registration approval flows are active, have no exploitable attack surface.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) characterizes this as a network-reachable, low-complexity flaw requiring low privilege - consistent with the scoped admin role requirement. The VC:L/VI:L ratings reflect limited impact on the vulnerable system itself, but the provided vector assigns SC:N/SI:N, which understates the cross-boundary nature of the flaw (out-of-scope agent groups are the actual impact target). No EPSS score was provided, no POC has been published, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. Real-world risk is moderate in multi-tenant NanoClaw deployments where multiple scoped admins exist: any one of them could pivot into restricted agent groups. Deployments with a single trusted admin pool face negligible risk. The absence of KEV and EPSS data limits probabilistic risk scoring; exploitation probability is inferred as low-to-moderate based on required authentication and niche product footprint.

A scoped admin with legitimate admin rights over agent group ag-1 participates in the channel-registration approval flow for an unknown incoming messaging channel. Rather than selecting connect:ag-1 from the presented options, the attacker manually submits the callback value connect:ag-2 (or any other out-of-scope agent group ID). Prior to the fix, handleChannelApprovalResponse executes the connection without validating the approver's privileges over ag-2, wiring the channel into the restricted group and granting the attacker passive observation or active messaging control over that group's activity. No public proof-of-concept code has been identified.