CVE-2026-56402: Nanocoai Nanoclaw

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation.

Affected products

• Nanocoai Nanoclaw: before 2.1.17 (fixed in 2.1.17)

Published 2026-06-23. Last modified 2026-09-17.