CVE-2026-56693

Medium

Description

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations, escalating beyond their intended confinement boundary.

SeverityMedium

CVSS5.5

Exploit probability—

ProductNanocoai Nanoclaw

PublishedJun 23, 2026

First seenJun 23, 2026

Weakness typeCWE-602CWE-602

How to fix

Update

nanocoai nanoclaw2.1.17 or later

Patches

github.com/nanocoai/nanoclaw/pull/2720
github.com/nanocoai/nanoclaw/commit/ac37ecbfd6b9d14fdfa1598a6412a8ffdbeaef45

Affected products

Product	Affected versions	Fixed in
nanocoai nanoclaw	v < 2.1.17	2.1.17

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.