CVE-2026-56692: NanoClaw Information Disclosure Flaw

CVE-2026-56692 Overview

CVE-2026-56692 is a symlink following vulnerability in NanoClaw versions before 2.1.17. The flaw resides in the forwardAttachedFiles function within the agent-to-agent attachment handling logic. A container-controlled agent can place a symbolic link in its outbox with a name that passes the isSafeAttachmentName filter. When the host copies the attachment using fs.copyFileSync, the call follows the symlink and reads files outside the agent sandbox. Attackers can exfiltrate any host-readable file through this primitive, classified under [CWE-59] Improper Link Resolution Before File Access.

Critical Impact
A malicious container agent can disclose arbitrary host files readable by the NanoClaw process, including configuration, credentials, and source code.

Affected Products

NanoClaw versions prior to 2.1.17
The forwardAttachedFiles routine in src/modules/agent-to-agent/agent-route.ts
Deployments running container-isolated agents that exchange attachments with the host

Discovery Timeline

2026-06-23 - CVE-2026-56692 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56692

Vulnerability Analysis

NanoClaw forwards attachments from a source agent's outbox into a target agent's inbox over its agent-to-agent (A2A) channel. The host-side handler validates only the attachment filename with isSafeAttachmentName, which rejects unsafe characters and path separators but does not inspect the underlying file type. Attachments are then duplicated with fs.copyFileSync, a Node.js API that transparently dereferences symbolic links. A container agent that controls its own outbox can replace an attachment entry with a symlink pointing anywhere on the host filesystem. The host process resolves the link and copies the target file content into the recipient inbox, where the malicious agent retrieves it.

Root Cause

The root cause is missing containment validation between filename safety checks and file system operations. isSafeAttachmentName enforces lexical rules on the attachment name but never verifies that the resolved real path stays inside the agent's outbox directory. fs.copyFileSync follows symlinks by default, turning a benign-looking filename into an arbitrary file read primitive.

Attack Vector

Exploitation requires local, low-privilege access as a container-controlled agent participating in the A2A protocol. The attacker creates a symlink inside their outbox, for example report.txt pointing to /etc/shadow or /root/.ssh/id_rsa. The attacker then triggers forwardAttachedFiles to deliver the attachment to a confederate agent and reads the copied content from the destination inbox.

typescript

   localPath: string;
 }
 
+function isPathInside(parent: string, child: string): boolean {
+  const relative = path.relative(parent, child);
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
 /**
  * Copy file attachments from the source agent's outbox into the target
  * agent's inbox. Returns attachments using the formatter's existing

Source: GitHub Commit 28032bc. The patch introduces an isPathInside helper that confines resolved paths to the expected parent directory before any copy operation.

Detection Methods for CVE-2026-56692

Indicators of Compromise

Symbolic links present inside agent outbox directories that resolve to paths outside the agent sandbox.
Files appearing in agent inboxes whose contents match sensitive host paths such as /etc/passwd, SSH keys, or environment secrets.
A2A attachment events where the source path and the copied content checksum diverge from prior baselines.

Detection Strategies

Audit NanoClaw deployments for any installation below version 2.1.17 across registries and running containers.
Instrument the host file system to log copyFileSync operations originating from the agent-route module and flag those that traverse symbolic links.
Compare attachment filenames against the resolved real paths and alert when the real path leaves the outbox root.

Monitoring Recommendations

Enable Linux audit rules on agent outbox directories to record symlink, symlinkat, and openat syscalls referencing them.
Forward NanoClaw A2A logs and host file-access telemetry to a central data lake for correlation across agents.
Alert on reads of high-value host paths such as /etc, /root, and credential stores by the NanoClaw process.

How to Mitigate CVE-2026-56692

Immediate Actions Required

Upgrade NanoClaw to version 2.1.17 or later on all hosts running the A2A service.
Inventory agent outbox directories and remove any unexpected symbolic links before restarting services.
Rotate credentials and keys readable by the NanoClaw process if exploitation is suspected.

Patch Information

The fix is delivered in commit 28032bc0eca76c91fb3d8be0013e8bcaf2f5aeae, merged via NanoClaw Pull Request #2468. The patch adds an isPathInside containment check that rejects attachments whose resolved real path falls outside the source agent's outbox. Additional context is available in the VulnCheck advisory for NanoClaw arbitrary file read.

Workarounds

Run NanoClaw under a dedicated low-privilege user with read access restricted to required directories only.
Mount agent outbox directories with the nosymfollow option where supported, or use bind mounts that exclude sensitive paths.
Apply mandatory access control policies such as AppArmor or SELinux to deny the NanoClaw process read access to credential stores.

bash

# Verify installed NanoClaw version and upgrade if below 2.1.17
npm ls @nanocoai/nanoclaw
npm install @nanocoai/nanoclaw@^2.1.17

# Find suspicious symlinks inside agent outbox directories
find /var/lib/nanoclaw/agents/*/outbox -type l -exec ls -l {} \;