CVE-2026-56402: NanoClaw Privilege Escalation Vulnerability

CVE-2026-56402 Overview

CVE-2026-56402 is a privilege escalation vulnerability in NanoClaw versions before 2.1.17. The flaw resides in the handleApprovalsResponse function, which processes approval responses for privileged actions such as package installation. The handler fails to verify that the responder holds an authorized role before acting on the response. Any attacker who possesses a valid questionId can submit a crafted approval payload and approve or reject privileged actions on behalf of legitimate approvers. The issue is tracked under CWE-862: Missing Authorization and was disclosed through a VulnCheck Advisory on Privilege Escalation.

Critical Impact
Authenticated low-privilege attackers with knowledge of a valid questionId can approve privileged operations such as package installation, bypassing the role-based approval workflow entirely.

Affected Products

NanoClaw versions prior to 2.1.17
NanoClaw approval workflow component (src/modules/approvals/response-handler.ts)
Deployments exposing the approval response endpoint over the network

Discovery Timeline

2026-06-23 - CVE-2026-56402 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56402

Vulnerability Analysis

NanoClaw implements an approval workflow in which privileged operations are gated behind a pending approval record identified by a questionId. Approvers click an interactive control, and the resulting payload is routed to handleApprovalsResponse. In versions before 2.1.17, the handler retrieves the pending approval but never validates that the user submitting the response holds an administrative or owner role. The handler treats any payload bearing a valid questionId as authoritative. Because privileged actions such as package installation rely on this approval gate, the missing authorization check breaks the trust boundary between standard users and administrators.

Root Cause

The root cause is a missing authorization check [CWE-862] within handleApprovalsResponse. The function looks up the pending approval through getPendingApproval(payload.questionId) but does not call any role-checking primitive such as hasAdminPrivilege, isGlobalAdmin, or isOwner before applying the approval decision. Role enforcement was assumed at the UI layer rather than the backend handler.

Attack Vector

The attack is network-based and requires low-privilege authenticated access. An attacker who learns or guesses a valid questionId for a pending approval submits a response payload containing the desired value (approve or reject). The handler accepts the response and proceeds to execute the gated action. This enables an attacker to authorize package installations or other privileged operations without holding the requisite role.

typescript

// Source: https://github.com/nanocoai/nanoclaw/commit/6227bd1a5b016fb1eb76411bb6681b4c924a51a0
 import { log } from '../../log.js';
 import { writeSessionMessage } from '../../session-manager.js';
 import type { PendingApproval } from '../../types.js';
+import { hasAdminPrivilege, isGlobalAdmin, isOwner } from '../permissions/db/user-roles.js';
 import { ONECLI_ACTION, resolveOneCLIApproval } from './onecli-approvals.js';
 import { getApprovalHandler } from './primitive.js';

 export async function handleApprovalsResponse(payload: ResponsePayload): Promise<boolean> {
-  // OneCLI credential approvals — resolved via in-memory Promise first.
-  if (resolveOneCLIApproval(payload.questionId, payload.value)) {
-    return true;
-  }
-
-  // DB-backed pending_approvals.
   const approval = getPendingApproval(payload.questionId);
   if (!approval) return false;

+  if (!isAuthorizedApprovalClick(approval, payload)) {
+    log.warn('Ignoring unauthorized approval response', {
+      approvalId: approval.approval_id,
+      action: approval.action,
+      userId: payload.userId,
+      channelType: payload.channelType,
+    });
+    return true;
+  }
+
   if (approval.action === ONECLI_ACTION) {
+    if (resolveOneCLIApproval(payload.questionId, payload.value)) {
+      return true;

The patch introduces an isAuthorizedApprovalClick gate that consults role helpers (hasAdminPrivilege, isGlobalAdmin, isOwner) before any approval state changes occur.

Detection Methods for CVE-2026-56402

Indicators of Compromise

Approval response events where the submitting userId does not match any administrator, owner, or global admin role in user-roles.
Repeated approval submissions referencing different questionId values from the same low-privilege account within short time windows.
Unexpected privileged actions, such as package installation, completing successfully without a corresponding approval click from an authorized reviewer.
Application logs lacking the Ignoring unauthorized approval response warning introduced by the fix, indicating the unpatched code path is still in use.

Detection Strategies

Audit NanoClaw application logs for approval responses correlated against the role of the submitting user; flag any mismatch.
Compare questionId issuance records against the responder identity to detect approvals consumed by users who were not the intended approver.
Monitor outbound effects of approved actions (package installs, configuration changes) and reconcile against the responder's privilege level.

Monitoring Recommendations

Enable verbose logging on the handleApprovalsResponse code path and forward events to a centralized log platform.
Alert on any approval-driven privileged action initiated by an account lacking admin, owner, or global admin roles.
Track installations of the NanoClaw package and confirm all instances are running version 2.1.17 or later.

How to Mitigate CVE-2026-56402

Immediate Actions Required

Upgrade NanoClaw to version 2.1.17 or later, which applies the authorization check via GitHub Pull Request #2478.
Inventory all NanoClaw deployments and confirm version status before exposing approval endpoints to untrusted networks.
Rotate or invalidate any pending approval records (questionId values) created prior to the upgrade to prevent replay against the unpatched handler.
Review recent privileged actions, particularly package installations, for approvals submitted by non-admin accounts.

Patch Information

The fix is delivered in commit 6227bd1a5b016fb1eb76411bb6681b4c924a51a0, merged via Pull Request #2478. The patch adds an isAuthorizedApprovalClick check that calls hasAdminPrivilege, isGlobalAdmin, and isOwner from permissions/db/user-roles.js before the approval response is honored. Unauthorized responses are logged and discarded.

Workarounds

Restrict network access to the NanoClaw approval response endpoint so that only trusted operator accounts can reach it.
Treat questionId values as sensitive secrets and avoid logging or transmitting them through channels accessible to low-privilege users.
Disable the package installation approval action until the patched version is deployed, where operationally feasible.

bash

# Verify installed NanoClaw version and upgrade to the fixed release
nanoclaw --version
npm install nanoclaw@2.1.17