EUVD-2026-38466
GHSA-p56g-x65g-wr86
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required scoped admin role; S:C because the exploit crosses agent group authorization boundaries, impacting components the attacker does not control; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.
AnalysisAI
Privilege escalation in NanoClaw before 2.1.0 lets scoped admins cross agent-group authorization boundaries by submitting forged or stale connect callback values during the channel-registration approval flow. The handleChannelApprovalResponse function accepted any connect:ag-X callback value without verifying that the approver held admin privileges over the target agent group, allowing a scoped admin to wire messaging channels into groups they do not govern. No active exploitation has been confirmed (not listed in CISA KEV), and an upstream fix is available in commit 0eef8fafdd7c475ab5fd8d37ea566a81e74cd834 (PR #2566).
Technical ContextAI
NanoClaw (CPE: cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*) is an AI agent management platform that implements multi-tenant agent groups with role-based access control. The channel-registration approval flow allows messaging channels (e.g., Telegram) to be interactively connected to agent groups via a response-handler callback mechanism. The root cause is CWE-863 (Incorrect Authorization): the buildApprovalOptions and buildAgentSelectionOptions functions presented all agent groups to any approver without filtering by privilege, and handleChannelApprovalResponse did not verify that the submitting admin held privileges over the target agent group before executing the connection. The fix introduces visibleAgentGroupsForApprover (which calls hasAdminPrivilege) to filter option lists and adds an explicit hasAdminPrivilege(approverId, targetAgentGroupId) guard in handleChannelApprovalResponse before any channel wiring occurs.
RemediationAI
Upgrade NanoClaw to version 2.1.0 or later, which includes the authorization guard added in commit 0eef8fafdd7c475ab5fd8d37ea566a81e74cd834 (https://github.com/nanocoai/nanoclaw/commit/0eef8fafdd7c475ab5fd8d37ea566a81e74cd834). Note that the patched release version is stated as 2.1.0 in the CVE description, but the upstream fix is available as a commit and PR rather than a confirmed published tagged release - verify the release artifact independently before deploying. As a compensating control pending upgrade, restrict the scoped admin role to only fully trusted users, since exploitation requires that role. Additionally, audit the messaging_group_agents and pending_channel_approvals database tables for unauthorized channel-to-agent-group associations that may indicate prior exploitation. Revoking scoped admin grants for untrusted users eliminates the attack surface entirely but may disrupt legitimate delegated administration workflows. Full details in the VulnCheck advisory at https://www.vulncheck.com/advisories/nanoclaw-privilege-escalation-via-forged-channel-approval-callback.
Path traversal in NanoClaw's container filesystem boundary allows compromised containers or prompt-injected agents to es
Privilege escalation in NanoClaw before 2.1.17 lets remote attackers with a valid questionId approve or reject privilege
Symlink following in NanoClaw's agent-to-agent file forwarding exposes arbitrary host-readable files to container-contro
Privilege escalation in NanoClaw before 2.1.17 allows confined agent containers to bypass their architectural confinemen
Improper authorization in nanocoai NanoClaw's add_mcp_server endpoint allows authenticated attackers with low privileges
Improper privilege management in NanoClaw (versions up to 2.0.64) allows authenticated remote attackers to abuse the `ha
We need answer JSON only. Need synthesize. Let's parse input. CVE-2026-90807. Product nanocoai NanoClaw up to 2.1.17. F
Improper authorization in NanoClaw's MCP Server Approval component allows local attackers to bypass security controls by
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today