CVE-2026-56693: Nanocoai Nanoclaw

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations, escalating beyond their intended confinement boundary.

Affected products

• Nanocoai Nanoclaw: before 2.1.17 (fixed in 2.1.17)

Published 2026-06-23. Last modified 2026-09-17.