Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-56402

NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nanocoai nanoclaw

Default version status: unaffected

  • 0 to < 2.1.17affected
  • 2.1.17unaffected
pkg:github/nanocoai/nanoclaw

References