What’s Vulnerable › Vulnerabilities

CVE-2026-56694: NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-23 · updated 2026-10-26
• Weakness: CWE-863

Description

NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.

Affected products

• nanocoai NanoClaw: before 2.1.0 — fixed in 2.1.0

How to fix

Upgrade to a fixed version: nanocoai NanoClaw 2.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/nanocoai/nanoclaw/commit/0eef8fafdd7c475ab5fd8d37ea566a81e74cd834
• https://github.com/nanocoai/nanoclaw/pull/2566
• https://www.vulncheck.com/advisories/nanoclaw-privilege-escalation-via-forged-channel-approval-callback

Get alerted when CVE-2026-56694 or the next vulnerability affects your stack