Nanoclaw
Monthly
Privilege escalation in NanoClaw before 2.1.17 lets remote attackers with a valid questionId approve or reject privileged actions (such as package installation) by submitting crafted approval response payloads. The handleApprovalsResponse function dispatches sensitive handlers without verifying the responder holds an owner/admin role, turning approval callbacks into an authorization bypass. Publicly available exploit code exists via the upstream patch diff, but no active exploitation is currently confirmed.
Path traversal in NanoClaw's container filesystem boundary allows compromised containers or prompt-injected agents to escape isolation and read arbitrary host files via crafted message IDs and attachment paths, with potential for recursive deletion of host directories during outbox cleanup. The vulnerability exploits insufficient validation of outbound attachment filenames and symlink resolution in the host-side message handling code. Upstream fix available (GitHub commit 7814e45) but released patched version not independently confirmed. No public exploit identified at time of analysis, though proof-of-concept test cases demonstrate both file exfiltration and destructive cleanup paths.
We need answer JSON only. Need synthesize. Let's parse input. CVE-2026-90807. Product nanocoai NanoClaw up to 2.1.17. Function forwardAttachedFiles in src/modules/agent-to-agent/agent-route.ts, component Attachment Handler. Link following (CWE-59). Attack remote. Exploit public. Patch commit 3f9ed... CVSS score 2.1 low. CVSS vector 4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. So requires low privileges? PR:L. Remote network. Low impacts all. CWE-59 link following. POC public. Patch available vendor exact commit, not necessarily version. Affected all versions 2.1.0 - 2.1.17 (EUVD list). CPE nanocoai:nanoclaw:* (all versions? maybe up to 2.1.17). Tags Information Disclosure, Nanoclaw, Nanocoai. Need produce JSON with fields. Must be plain text strings, no arrays except data_quality_flags array. Need careful. Product name: "NanoClaw" maybe one word. Or "nanocoai NanoClaw"? 1-3 words. Use "NanoClaw". Summary: 2-3 sentence. Must not start with "A vulnerability" etc. Start with impact verb and product. Link following in NanoClaw's attachment handler allows remote low-privileged attackers to read/write/delete files? CWE-59 link following. forwardAttachedFiles follows symbolic links? Public exploit exists. Patch commit. EPSS not given. KEV no. CVSS 2.1 low. Mention affected up to 2.1.17, all 2.1.x. Attack remote. Low privileges. Public exploit code exists. Patch available. Technical context: TypeScript/Node agent-to-agent module, attachment handler forwardAttachedFiles follows links. CWE-59 improper link resolution before file access. CPE. Risk assessment: CVSS 4.0 2.1 low, AV:N, AC:L, AT:N, PR:L, UI:N, VC:L/VI:L/VA:L. Public exploit increases likelihood. No KEV, no EPSS. Low impact but easy. Real risk low-moderate? Need compare signals. Note CVSS 4.0 base score 2.1 due to E:P? Base without E maybe? Actually score 2.1 is low. But PR:L means authenticated. Public exploit. No KEV. No EPSS. State. Affected products: NanoClaw versions 2.1.0 through 2.
Improper privilege management in NanoClaw (versions up to 2.0.64) allows authenticated remote attackers to abuse the `handleCreateAgent` function within the agent-to-agent creation module to escalate privileges beyond their authorization level. A public proof-of-concept exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure, leaving deployments unpatched. No public exploit identified as actively exploited in CISA KEV, but the public POC and absence of a vendor patch materially elevate near-term exploitation risk.
Improper authorization in nanocoai NanoClaw's add_mcp_server endpoint allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions, such as adding MCP servers without proper authorization. Versions up to and including 2.0.64 are affected, and publicly available exploit code exists. A vendor patch is available via commit e5b928783d5c485637565eb07d2967922dfbf8d8.
Improper authorization in NanoClaw's MCP Server Approval component allows local attackers to bypass security controls by manipulating the createChatSdkBridge.setup function. The vulnerability affects all versions up to 2.0.64, and a public exploit is available, although no active exploitation or CISA KEV inclusion has been confirmed.
Privilege escalation in NanoClaw before 2.1.0 lets scoped admins cross agent-group authorization boundaries by submitting forged or stale connect callback values during the channel-registration approval flow. The `handleChannelApprovalResponse` function accepted any `connect:ag-X` callback value without verifying that the approver held admin privileges over the target agent group, allowing a scoped admin to wire messaging channels into groups they do not govern. No active exploitation has been confirmed (not listed in CISA KEV), and an upstream fix is available in commit 0eef8fafdd7c475ab5fd8d37ea566a81e74cd834 (PR #2566).
Privilege escalation in NanoClaw before 2.1.17 allows confined agent containers to bypass their architectural confinement boundary by invoking the `create_agent` delivery-action handler without host-side authorization. The handler performed privileged central-database writes - creating agent groups, container configurations, and destinations - gated only by a container-side MCP tool check that, being inside the untrusted container, is trivially bypassed by writing outbound system rows directly. No public exploit identified at time of analysis; a vendor patch is available and the fix is documented in a public GitHub commit.
Symlink following in NanoClaw's agent-to-agent file forwarding exposes arbitrary host-readable files to container-controlled agents. All releases before 2.1.17 are affected; the `forwardAttachedFiles` function validated attachment filenames with `isSafeAttachmentName` but called `fs.copyFileSync` without first resolving symlinks or confirming the resolved path remained inside the agent's outbox directory. A low-privileged agent can craft a symlink with a safe-looking filename, point it at any host file readable by the NanoClaw process, and receive its contents forwarded as a message attachment. No public exploit is identified at time of analysis, though the VulnCheck advisory and GitHub PR diff provide sufficient detail for a technically capable attacker to reproduce exploitation.
Privilege escalation in NanoClaw before 2.1.17 lets remote attackers with a valid questionId approve or reject privileged actions (such as package installation) by submitting crafted approval response payloads. The handleApprovalsResponse function dispatches sensitive handlers without verifying the responder holds an owner/admin role, turning approval callbacks into an authorization bypass. Publicly available exploit code exists via the upstream patch diff, but no active exploitation is currently confirmed.
Path traversal in NanoClaw's container filesystem boundary allows compromised containers or prompt-injected agents to escape isolation and read arbitrary host files via crafted message IDs and attachment paths, with potential for recursive deletion of host directories during outbox cleanup. The vulnerability exploits insufficient validation of outbound attachment filenames and symlink resolution in the host-side message handling code. Upstream fix available (GitHub commit 7814e45) but released patched version not independently confirmed. No public exploit identified at time of analysis, though proof-of-concept test cases demonstrate both file exfiltration and destructive cleanup paths.
We need answer JSON only. Need synthesize. Let's parse input. CVE-2026-90807. Product nanocoai NanoClaw up to 2.1.17. Function forwardAttachedFiles in src/modules/agent-to-agent/agent-route.ts, component Attachment Handler. Link following (CWE-59). Attack remote. Exploit public. Patch commit 3f9ed... CVSS score 2.1 low. CVSS vector 4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. So requires low privileges? PR:L. Remote network. Low impacts all. CWE-59 link following. POC public. Patch available vendor exact commit, not necessarily version. Affected all versions 2.1.0 - 2.1.17 (EUVD list). CPE nanocoai:nanoclaw:* (all versions? maybe up to 2.1.17). Tags Information Disclosure, Nanoclaw, Nanocoai. Need produce JSON with fields. Must be plain text strings, no arrays except data_quality_flags array. Need careful. Product name: "NanoClaw" maybe one word. Or "nanocoai NanoClaw"? 1-3 words. Use "NanoClaw". Summary: 2-3 sentence. Must not start with "A vulnerability" etc. Start with impact verb and product. Link following in NanoClaw's attachment handler allows remote low-privileged attackers to read/write/delete files? CWE-59 link following. forwardAttachedFiles follows symbolic links? Public exploit exists. Patch commit. EPSS not given. KEV no. CVSS 2.1 low. Mention affected up to 2.1.17, all 2.1.x. Attack remote. Low privileges. Public exploit code exists. Patch available. Technical context: TypeScript/Node agent-to-agent module, attachment handler forwardAttachedFiles follows links. CWE-59 improper link resolution before file access. CPE. Risk assessment: CVSS 4.0 2.1 low, AV:N, AC:L, AT:N, PR:L, UI:N, VC:L/VI:L/VA:L. Public exploit increases likelihood. No KEV, no EPSS. Low impact but easy. Real risk low-moderate? Need compare signals. Note CVSS 4.0 base score 2.1 due to E:P? Base without E maybe? Actually score 2.1 is low. But PR:L means authenticated. Public exploit. No KEV. No EPSS. State. Affected products: NanoClaw versions 2.1.0 through 2.
Improper privilege management in NanoClaw (versions up to 2.0.64) allows authenticated remote attackers to abuse the `handleCreateAgent` function within the agent-to-agent creation module to escalate privileges beyond their authorization level. A public proof-of-concept exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure, leaving deployments unpatched. No public exploit identified as actively exploited in CISA KEV, but the public POC and absence of a vendor patch materially elevate near-term exploitation risk.
Improper authorization in nanocoai NanoClaw's add_mcp_server endpoint allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions, such as adding MCP servers without proper authorization. Versions up to and including 2.0.64 are affected, and publicly available exploit code exists. A vendor patch is available via commit e5b928783d5c485637565eb07d2967922dfbf8d8.
Improper authorization in NanoClaw's MCP Server Approval component allows local attackers to bypass security controls by manipulating the createChatSdkBridge.setup function. The vulnerability affects all versions up to 2.0.64, and a public exploit is available, although no active exploitation or CISA KEV inclusion has been confirmed.
Privilege escalation in NanoClaw before 2.1.0 lets scoped admins cross agent-group authorization boundaries by submitting forged or stale connect callback values during the channel-registration approval flow. The `handleChannelApprovalResponse` function accepted any `connect:ag-X` callback value without verifying that the approver held admin privileges over the target agent group, allowing a scoped admin to wire messaging channels into groups they do not govern. No active exploitation has been confirmed (not listed in CISA KEV), and an upstream fix is available in commit 0eef8fafdd7c475ab5fd8d37ea566a81e74cd834 (PR #2566).
Privilege escalation in NanoClaw before 2.1.17 allows confined agent containers to bypass their architectural confinement boundary by invoking the `create_agent` delivery-action handler without host-side authorization. The handler performed privileged central-database writes - creating agent groups, container configurations, and destinations - gated only by a container-side MCP tool check that, being inside the untrusted container, is trivially bypassed by writing outbound system rows directly. No public exploit identified at time of analysis; a vendor patch is available and the fix is documented in a public GitHub commit.
Symlink following in NanoClaw's agent-to-agent file forwarding exposes arbitrary host-readable files to container-controlled agents. All releases before 2.1.17 are affected; the `forwardAttachedFiles` function validated attachment filenames with `isSafeAttachmentName` but called `fs.copyFileSync` without first resolving symlinks or confirming the resolved path remained inside the agent's outbox directory. A low-privileged agent can craft a symlink with a safe-looking filename, point it at any host file readable by the NanoClaw process, and receive its contents forwarded as a message attachment. No public exploit is identified at time of analysis, though the VulnCheck advisory and GitHub PR diff provide sufficient detail for a technically capable attacker to reproduce exploitation.