Privilege Escalation Vulnerability in NanoClaw by NanoCo AI
CVE-2026-56402

7.1HIGH

Key Information:

Vendor

Nanocoai

Status
Nanoclaw
Vendor
CVE Published:
23 June 2026

What is CVE-2026-56402?

NanoClaw prior to version 2.1.17 is susceptible to a privilege escalation flaw within the handleApprovalsResponse function. This vulnerability arises from the improper validation of responder role authorization. An attacker possessing a valid questionId could potentially approve or reject privileged actions, including the installation of packages, by sending crafted approval response payloads without the necessary role verification. This security lapse could pose significant risks to system integrity and confidentiality.

Affected Version(s)

nanoclaw 0 < 2.1.17

nanoclaw 2.1.17

References

https://github.com/nanocoai/nanoclaw/pull/2478
issue-tracking
https://github.com/nanocoai/nanoclaw/commit/6227bd1a5b016...
patch
https://www.vulncheck.com/advisories/nanoclaw-privilege-e...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chia Min Jun Lennon
.