CVE-2026-56693— NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-56693
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action
Source: NVD (National Vulnerability Database)
Vulnerability Description
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations, escalating beyond their intended confinement boundary.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端安全的客户端实施
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-56693
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56693
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56693 (1)
Other References for CVE-2026-56693 (2)
Same Patch Batch · nanocoai · 2026-06-23 · 4 CVEs total
| CVE-2026-56402 | 6.5 MEDIUM | NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler |
| CVE-2026-56692 | 5.5 MEDIUM | NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles |
| CVE-2026-56694 | 5.4 MEDIUM | NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback |
IV. Related Vulnerabilities
Same product: nanoclaw
V. Comments for CVE-2026-56693
No comments yet