NanoClaw EUVD-2026-38465

Exploitation requires execution context within a confined NanoClaw agent container assigned a non-'global' CLI scope ('group', 'disabled', or missing config). The attacker must be able to write outbound system rows from within the container runtime to the host's central database - access that is architecturally available to all containers but was intended to be gated by the (now-fixed) missing host-side authorization check. Containers operating under 'global' scope are not vulnerable, as they were already trusted to create agents directly. Exploitation does not require user interaction and has low attack complexity once container access is established. The primary limiting factor is the local attack vector (AV:L): an attacker must first gain or influence execution inside a confined container, most plausibly via prompt injection in an agentic pipeline. Default-configured confined deployments are affected; environments with only 'global'-scope agents or with create_agent tool exposure fully disabled are not exploitable.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) scores 6.8 (Medium), reflecting a local attack requiring low privilege and producing high integrity impact. The local attack vector is the primary severity limiter - an attacker must already have execution inside a confined agent container. In agentic pipeline deployments, however, this bar is relatively low: prompt injection against a confined container is a plausible initial foothold, after which this vulnerability enables full confinement escape to the host central database. No EPSS score was available in the provided intelligence, and NanoClaw is not listed in the CISA KEV catalog. No public exploit code has been identified at time of analysis, though the public GitHub PR diff explicitly documents the vulnerability mechanism and the bypass method, lowering the bar for exploitation by observers of the repository. The real-world risk is most acute in multi-tenant or shared NanoClaw deployments where agent confinement is a meaningful security boundary - in single-user or fully-trusted deployments the practical impact is lower.

An adversary who controls or has compromised a confined NanoClaw agent container (via prompt injection or a malicious task payload) crafts an outbound create_agent system row and writes it directly to the host central database, bypassing the container-side MCP gate entirely. This creates a new agent group with elevated permissions outside the attacker's confinement boundary, effectively escaping container isolation. The public PR diff documenting the exact bypass path lowers the barrier for constructing such an exploit, though no ready-made proof-of-concept has been observed at time of analysis.