Threat Intelligence Database

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The exploit has been made public and could be used. The patch is identified as 3f9ed607b7e7a4872747295f75286f1c377d7c33. It is advisable to implement a patch to correct this issue.

CVE-2026-19005 is a medium severity vulnerability in nanocoai NanoClaw up to version 2.0.64. It involves improper privilege management in the handleCreateAgent function of the Child-Agent Creation component. The vulnerability allows remote exploitation through manipulation, potentially leading to unauthorized privilege escalation. The issue was reported early to the project, but no response or fix has been provided yet. Exploit code is publicly available, increasing the risk of exploitation.

CVE-2026-18991 is a path traversal vulnerability in nanocoai NanoClaw affecting versions up to 2.0.64. The flaw exists in the send_file component of the file container/agent-runner/src/mcp-tools/core.ts. This vulnerability allows remote attackers to manipulate file paths, potentially accessing unauthorized files. The issue was publicly disclosed and an exploit is available, but the vendor has not yet responded or provided a fix.

CVE-2026-17434 is a medium severity vulnerability in nanocoai NanoClaw up to version 2.0.64. It involves improper authorization in the handleAddMcpServer function within the add_mcp_server component. The flaw can be exploited remotely to bypass authorization controls. An exploit has been published. A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 is available to remediate the issue.

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations, escalating beyond their intended confinement boundary.

NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only isSafeAttachmentName before copying with fs.copyFileSync, which follows symlinks without containment checks, allowing malicious agents to disclose arbitrary host files.

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation.

NanoClaw version 1.2.0 and prior contains a host/container filesystem boundary vulnerability in outbound attachment handling and outbox cleanup that allows a compromised or prompt-injected container to read files outside the intended outbox directory by supplying crafted messages_out.id and content.files values or creating symlinked outbox files. Attackers can exploit this vulnerability to trigger host-side reads of arbitrary files and in some cases achieve recursive deletion of paths outside the intended cleanup target.