CVE-2026-19005 is a vulnerability in nanocoai NanoClaw (up to 2.0.64) specifically in the handleCreateAgent function within src/modules/agent-to-agent/create-agent.ts. The issue is improper privilege management (CWE-266) that allows remote attackers to manipulate the function, potentially leading to unauthorized privilege escalation. The vulnerability has a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating a low severity impact with network attack vector, low attack complexity, and requiring low privileges but no user interaction. Exploit code is publicly available, and the project has not yet issued a fix or response.

The vulnerability allows remote attackers with low privileges to manipulate the Child-Agent Creation process, resulting in improper privilege management. This can lead to limited confidentiality, integrity, and availability impacts. The overall severity is low, reflecting the limited scope of impact and required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restrict access to the affected functionality and limit privileges of users who can interact with the handleCreateAgent function to reduce risk.