CVE-2026-56694
Medium
Description
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.
SeverityMedium
CVSS5.4
Exploit probability—
ProductNanocoai Nanoclaw
PublishedJun 23, 2026
First seenJun 23, 2026
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- nanocoai nanoclaw2.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nanocoai nanoclaw | v < 2.1.0 | 2.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.