TI-2026-61710 CVE-2026-90807 · GHSA-6pc7-x5hm-c6fj
nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following
Priority MEDIUM 57
A vulnerability was found in nanocoai NanoClaw up to 2.1.17.
Vulnerabilities
9 records
TI-2026-15531 CVE-2026-19005 · GHSA-grxx-9qr2-2q6v
nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management
Priority MEDIUM 57
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64.
TI-2026-15518 CVE-2026-18991 · GHSA-q94p-g4rh-r9rf
nanocoai NanoClaw send_file core.ts path traversal
Priority HIGH 70
A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64.
TI-2026-14327 CVE-2026-17434 · GHSA-m5r3-634q-m3rj
nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization
Priority MEDIUM 57
A flaw has been found in nanocoai NanoClaw up to 2.0.64.
TI-2026-14326 CVE-2026-17433 · GHSA-6frr-4xvp-cwch
nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
Priority MEDIUM 55
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64.
TI-2026-40874 CVE-2026-56694 · GHSA-p56g-x65g-wr86
NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback
Priority LOW 24
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups.
TI-2026-40873 CVE-2026-56693 · GHSA-7pvg-qfjr-jg4r
NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action
Priority LOW 29
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks.
TI-2026-40872 CVE-2026-56692 · GHSA-6373-p7g2-mx2w
NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles
Priority LOW 29
NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files.
TI-2026-40760 CVE-2026-56402 · GHSA-mhq9-hcw8-22mj
NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler
Priority MEDIUM 64
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization.