This vulnerability in nanocoai NanoClaw versions 2.0.0 through 2.0.64 involves improper privilege management in the handleCreateAgent function of the Child-Agent Creation module. An attacker can manipulate this function remotely to gain elevated privileges improperly. The issue was reported early to the project, but no remediation or patch has been provided as of the publication date. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, and limited privileges required for exploitation.

Successful exploitation allows an attacker to perform unauthorized privilege escalation remotely, potentially compromising the affected system's security posture. The vulnerability affects all versions up to 2.0.64, and public exploit code exists, increasing the risk of exploitation. However, there is no evidence of active exploitation in the wild at this time.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates and consider implementing compensating controls to restrict access to the affected functionality until a patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.