CVE-2026-56694 is a privilege escalation vulnerability in nanocoai's nanoclaw product before version 2.1.0. The issue arises because the channel-registration approval flow, specifically the handleChannelApprovalResponse function, fails to validate that the admin has privileges over the target agent groups. This allows scoped admins to forge or reuse connect callback values to wire messaging channels into agent groups outside their authorized scope. Consequently, unauthorized agent groups can be connected to channels they should not access, potentially allowing unauthorized observation or control of those groups' activities.

The vulnerability enables scoped administrators to escalate privileges by associating messaging channels with agent groups beyond their authorization. This can lead to unauthorized exposure of restricted agent groups to unapproved channels, allowing unauthorized observation or control of sensitive activities within those groups. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict admin privileges carefully and monitor for suspicious channel registration activities related to agent groups.