CVE-2026-18991: NanoClaw Path Traversal Vulnerability

CVE-2026-18991 Overview

CVE-2026-18991 is a path traversal vulnerability [CWE-22] in nanocoai NanoClaw versions up to 2.0.64. The flaw resides in the send_file component within container/agent-runner/src/mcp-tools/core.ts. Attackers can manipulate file path inputs to access files outside the intended directory. The vulnerability is remotely exploitable without authentication or user interaction. The exploit has been publicly disclosed, and the project maintainers have not responded to the initial issue report.

Critical Impact
Remote attackers can read arbitrary files on the host running NanoClaw's agent-runner by supplying crafted path inputs to the send_file tool, exposing configuration data, secrets, and source code.

Affected Products

nanocoai NanoClaw versions up to and including 2.0.64
Component: container/agent-runner/src/mcp-tools/core.ts (send_file tool)
Deployments exposing the MCP tools interface over a network

Discovery Timeline

2026-08-06 - CVE-2026-18991 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18991

Vulnerability Analysis

The vulnerability affects NanoClaw's agent-runner, specifically the MCP (Model Context Protocol) tools implementation in core.ts. The send_file tool accepts a file path parameter and returns file contents but fails to properly validate or canonicalize the supplied path. Attackers can inject traversal sequences such as ../ to escape the intended base directory.

Because NanoClaw is designed for AI-agent workflows, the send_file capability is typically invoked by an LLM or a remote client. Exposing this tool without strict path enforcement allows unauthenticated network callers to retrieve arbitrary files accessible to the agent-runner process.

Root Cause

The root cause is missing or insufficient path sanitization in the send_file handler. The code does not resolve the canonical path and verify that it remains within an allowlisted directory before opening the file. This maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted send_file request containing a path with ../ sequences or an absolute path targeting sensitive files such as /etc/passwd, application configuration files, or .env files containing API keys. See the GitHub Issue Discussion and VulDB CVE Details for additional technical context.

// No verified exploit code available.
// The vulnerability is triggered by supplying a path
// containing traversal sequences to the send_file tool,
// causing the agent-runner to read files outside the
// intended working directory.

Detection Methods for CVE-2026-18991

Indicators of Compromise

Requests to the NanoClaw agent-runner MCP endpoint containing ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths
Access log entries showing send_file invocations referencing files outside the application's working directory
Unexpected reads of sensitive files such as /etc/passwd, /etc/shadow, .env, or SSH key material by the agent-runner process

Detection Strategies

Inspect agent-runner logs for send_file calls whose resolved path does not reside under the expected base directory
Deploy web application firewall or reverse-proxy rules that flag path traversal patterns in requests to NanoClaw endpoints
Correlate process-level file access telemetry with MCP tool invocations to identify anomalous read targets

Monitoring Recommendations

Enable verbose logging on the send_file handler to capture the raw and resolved paths for every request
Alert on any file access by the agent-runner process outside a defined allowlist of directories
Monitor network egress for exfiltration of file contents following suspicious send_file requests

How to Mitigate CVE-2026-18991

Immediate Actions Required

Restrict network exposure of the NanoClaw agent-runner to trusted internal networks only, using firewalls or reverse-proxy access controls
Disable or remove the send_file MCP tool if it is not required by your workflow
Run the agent-runner as an unprivileged user inside a container with a minimal, read-only filesystem
Rotate any secrets, API keys, or credentials accessible from the agent-runner host, as they may have been exposed

Patch Information

At the time of publication, no vendor patch is available. The project was notified through an issue report but has not responded. Track the GitHub Project Repository and the GitHub Issue Discussion for remediation updates.

Workarounds

Implement a reverse-proxy filter that rejects requests to send_file containing .., backslashes, or absolute paths
Chroot or containerize the agent-runner with a bind-mounted directory containing only files intended to be served
Apply a local patch that canonicalizes the requested path with path.resolve() and verifies it starts with an allowlisted base directory before opening the file

bash

# Example nginx reverse-proxy filter blocking traversal patterns
location /mcp/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://nanoclaw-agent-runner;
}