TI-2026-15518 CVE-2026-18991 · GHSA-q94p-g4rh-r9rf
nanocoai NanoClaw send_file core.ts path traversal
Priority HIGH 70
A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64.
nanocoai
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
nanocoai records in CISA KEVNo nanocoai vulnerabilities are listed in CISA KEV.
Records
9 records
TI-2026-40760 CVE-2026-56402 · GHSA-mhq9-hcw8-22mj
NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler
Priority MEDIUM 64
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization.
TI-2026-61710 CVE-2026-90807 · GHSA-6pc7-x5hm-c6fj
nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following
Priority MEDIUM 57
A vulnerability was found in nanocoai NanoClaw up to 2.1.17.
TI-2026-15531 CVE-2026-19005 · GHSA-grxx-9qr2-2q6v
nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management
Priority MEDIUM 57
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64.
TI-2026-14327 CVE-2026-17434 · GHSA-m5r3-634q-m3rj
nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization
Priority MEDIUM 57
A flaw has been found in nanocoai NanoClaw up to 2.0.64.
TI-2026-14326 CVE-2026-17433 · GHSA-6frr-4xvp-cwch
nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
Priority MEDIUM 55
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64.
TI-2026-40873 CVE-2026-56693 · GHSA-7pvg-qfjr-jg4r
NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action
Priority LOW 29
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks.
TI-2026-40872 CVE-2026-56692 · GHSA-6373-p7g2-mx2w
NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles
Priority LOW 29
NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files.
TI-2026-40874 CVE-2026-56694 · GHSA-p56g-x65g-wr86
NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback
Priority LOW 24
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups.