EUVD-2026-53717
GHSA-grxx-9qr2-2q6v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low privilege required; scope unchanged and all CIA impacts are partial, consistent with bounded privilege escalation within the platform.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Improper privilege management in NanoClaw (versions up to 2.0.64) allows authenticated remote attackers to abuse the handleCreateAgent function within the agent-to-agent creation module to escalate privileges beyond their authorization level. A public proof-of-concept exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure, leaving deployments unpatched. No public exploit identified as actively exploited in CISA KEV, but the public POC and absence of a vendor patch materially elevate near-term exploitation risk.
Technical ContextAI
NanoClaw (CPE: cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*) is an AI agent orchestration platform developed by nanocoai that implements agent-to-agent (A2A) workflows. The vulnerability resides specifically in the handleCreateAgent function within src/modules/agent-to-agent/create-agent.ts, the component responsible for spawning child agents. CWE-269 (Improper Privilege Management) identifies the root cause as a failure to correctly enforce authorization boundaries during child agent instantiation - the function likely does not validate whether the calling user or agent is permitted to grant specific permission levels to newly created child agents, enabling privilege inheritance or direct privilege assignment beyond what the caller is entitled to. The CVSS 4.0 vector confirms the attack is network-delivered (AV:N), requires low complexity (AC:L), no specific attack prerequisites (AT:N), and only low existing privileges (PR:L).
RemediationAI
No vendor-released patch has been identified at time of analysis - the nanocoai project had not responded to the coordinated disclosure as of the report date. Monitor the NanoClaw GitHub repository (https://github.com/nanocoai/nanoclaw/) and VulDB entry (https://vuldb.com/vuln/386386) for patch releases. As a compensating control, restrict access to the agent-to-agent creation API endpoints (those routed through handleCreateAgent in src/modules/agent-to-agent/create-agent.ts) to only the highest-privilege roles or service accounts, accepting the trade-off that lower-privileged users will lose the ability to create child agents. If network segmentation is feasible, limit the NanoClaw API surface to trusted internal networks or VPN-authenticated clients only, reducing the effective attack population despite PR:L not requiring full admin access. Organizations with high-sensitivity deployments should evaluate temporarily disabling the Child-Agent Creation feature entirely until an official fix is released.
Path traversal in NanoClaw's container filesystem boundary allows compromised containers or prompt-injected agents to es
Privilege escalation in NanoClaw before 2.1.17 lets remote attackers with a valid questionId approve or reject privilege
Symlink following in NanoClaw's agent-to-agent file forwarding exposes arbitrary host-readable files to container-contro
Privilege escalation in NanoClaw before 2.1.17 allows confined agent containers to bypass their architectural confinemen
Improper authorization in nanocoai NanoClaw's add_mcp_server endpoint allows authenticated attackers with low privileges
We need answer JSON only. Need synthesize. Let's parse input. CVE-2026-90807. Product nanocoai NanoClaw up to 2.1.17. F
Improper authorization in NanoClaw's MCP Server Approval component allows local attackers to bypass security controls by
Privilege escalation in NanoClaw before 2.1.0 lets scoped admins cross agent-group authorization boundaries by submittin
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today