CVE-2026-56694 | BDVDB-2026-342421 Detail

Description#

NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-06-23Record published in the CVE List.
2. Version 22026-09-17Most recent update recorded in the CVE List.