CVE-2026-56694: Nanocoai Nanoclaw

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.

Affected products

• Nanocoai Nanoclaw: before 2.1.0 (fixed in 2.1.0)

Published 2026-06-23. Last modified 2026-09-17.