NanoClaw EUVD-2026-38464

Exploitation requires the attacker to control an agent process with write access to that agent's own outbox directory within a NanoClaw deployment (PR:L per CVSS 4.0 - low-privilege agent-level access). The attacker must also have OS-level permission to create symbolic links within the outbox directory; on most Linux deployments this is available to any process that owns the directory. The vulnerable code path is only reachable when inter-agent message forwarding with file attachments is in use - NanoClaw deployments that do not use the agent-to-agent attachment forwarding feature are not exposed via this path. Exploitation is bounded by the filesystem permissions of the NanoClaw host process: files readable only by root or other high-privilege users are not accessible unless NanoClaw itself runs with elevated privileges. No network access by the attacker is required; the attack is entirely local to the host running the NanoClaw process.

CVSS 4.0 scores this at 6.8 with AV:L/PR:L, accurately reflecting that exploitation is constrained to the local host and requires at minimum agent-process-level access - this is not a remotely exploitable, unauthenticated attack. The high confidentiality impact (VC:H) is well-calibrated: any file readable by the NanoClaw host process, including secrets, credentials, and private keys, can be exfiltrated. No EPSS score is provided, this CVE does not appear in CISA KEV, and no standalone POC exploit has been published, meaning active widespread exploitation is unconfirmed. However, the VulnCheck advisory combined with the PR diff amounts to a near-complete recipe for exploitation, so treating this as 'low exploitability' would understate realistic risk for organizations running NanoClaw in multi-tenant or untrusted-agent configurations. The primary risk scenario is a compromised or deliberately malicious agent process - a realistic threat model in AI agent orchestration platforms where third-party or user-supplied agents may execute.

An attacker controlling an agent process creates a file named invoice.pdf inside the agent's outbox directory that is actually a symlink to /home/nanoclaw/.ssh/id_rsa or /etc/shadow. The agent sends a message to another agent listing invoice.pdf as an attachment; NanoClaw's unpatched forwardAttachedFiles passes the filename check, calls fs.copyFileSync which follows the symlink, and delivers the host private key contents to the destination agent's inbox. No public exploit code exists, but the GitHub PR test case at https://github.com/nanocoai/nanoclaw/pull/2468 demonstrates the exact exploit pattern.