CVE-2026-56693: NanoClaw Privilege Escalation Vulnerability

CVE-2026-56693 Overview

CVE-2026-56693 is a privilege escalation vulnerability in NanoClaw versions prior to 2.1.17. The flaw resides in the create_agent delivery-action handler, which performs privileged central-database writes without host-side authorization checks. Confined agent containers can invoke create_agent to create arbitrary agent groups, container configurations, and destinations. This lets a constrained workload escalate beyond its intended confinement boundary. The weakness is classified under [CWE-602] Client-Side Enforcement of Server-Side Security, reflecting the trust placed in an untrusted container to gate its own privileged requests.

Critical Impact
A confined NanoClaw agent container can write directly to the central database, creating new agents, container configurations, and destinations to break out of its scope and gain administrative control over the orchestrator.

Affected Products

NanoClaw versions prior to 2.1.17
NanoClaw container/agent-runner component (mcp-tools/agents.ts)
NanoClaw agent-to-agent module (src/modules/agent-to-agent/)

Discovery Timeline

2026-06-23 - CVE-2026-56693 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56693

Vulnerability Analysis

NanoClaw exposes a set of Model Context Protocol (MCP) tools to agent containers, including a delivery action named create_agent. The original design assumed create_agent was admin-only and that non-admin containers would not see the tool via mcp-tools/index.ts. The host was expected to re-check permission on receive, but that authorization check was absent. The create_agent handler wrote central-database state directly when invoked, with no host-side gate to distinguish trusted global-scope owner groups from confined groups. Because the container is untrusted, relying on its tool-list filtering to prevent invocation provides no real security boundary.

Root Cause

The root cause is missing server-side authorization on a privileged inter-process action. The container runtime acted as the policy enforcement point for what should have been a host-enforced decision. Confined containers retained the ability to send the create_agent outbound request, and the host accepted and applied it without scope verification.

Attack Vector

Exploitation requires local access as a confined agent container with low privileges. The attacker invokes the create_agent delivery action from within their container. The host writes the new agent group, container configuration, or destination into the central database without checking whether the requesting group has global scope. The newly created entities then operate outside the original confinement.

typescript

// Patch excerpt: container/agent-runner/src/mcp-tools/agents.ts
  * send_message(to="agent-name") since agents and channels share the
  * unified destinations namespace.
  *
- * create_agent is admin-only. Non-admin containers never see this tool
- * (see mcp-tools/index.ts). The host re-checks permission on receive.
+ * create_agent writes central-DB state. The host authorizes it by CLI scope:
+ * trusted owner agent groups (scope 'global') create directly; confined groups
+ * require admin approval (see src/modules/agent-to-agent/create-agent.ts). This
+ * tool just writes the outbound request; authorization is enforced host-side,
+ * not here — the container is untrusted and cannot be relied on to gate itself.
  */
 import { writeMessageOut } from '../db/messages-out.js';
 import { registerTools } from './server.js';

Source: GitHub Commit ac37ecb

Detection Methods for CVE-2026-56693

Indicators of Compromise

Central-database writes creating new agent groups, container configurations, or destinations that originated from a non-global-scope container.
create_agent delivery-action messages appearing in outbound message queues from confined agent containers.
Unexpected new entries in the destinations namespace correlated with low-privilege agent activity.

Detection Strategies

Audit messages-out and delivery-action logs for create_agent invocations and correlate against the source container's CLI scope.
Compare the set of agent groups, containers, and destinations against a known-good baseline and flag entities created without an approval record.
Review NanoClaw host logs for applyCreateAgent executions that lack a corresponding admin approval event on confined groups.

Monitoring Recommendations

Forward NanoClaw host and agent-runner logs to a centralized analytics platform with retention sufficient to investigate post-creation activity.
Alert on any create_agent request originating from a group whose scope is not global and that lacks a paired approval entry.
Track database write rates for the agent, container, and destination tables to surface anomalous bulk creation.

How to Mitigate CVE-2026-56693

Immediate Actions Required

Upgrade NanoClaw to version 2.1.17 or later, which moves authorization for create_agent to the host and requires admin approval for confined groups.
Inventory existing agent groups, container configurations, and destinations and remove any entities that cannot be tied to a legitimate approval.
Restrict which agent groups carry global scope and reserve that scope for trusted owner workloads only.

Patch Information

The fix is delivered through pull request #2720 and commit ac37ecbfd6b9d14fdfa1598a6412a8ffdbeaef45. The patch registers a matching approval handler so that the delivery action queues the request and applyCreateAgent runs only on approval. Trusted global-scope groups continue to create directly. See the VulnCheck Advisory for NanoClaw for additional context.

Workarounds

If upgrading is not immediately possible, remove the create_agent tool registration for all non-global-scope containers and verify host-side that messages of this type are rejected.
Disable inter-agent on-demand agent creation entirely until the patched release can be deployed.
Apply strict local access controls so that only trusted operators can launch confined NanoClaw containers.

bash

# Verify the installed NanoClaw version meets the fixed release
nanoclaw --version

# Upgrade to the patched release
npm install nanoclaw@^2.1.17