CVE-2026-56694: NanoClaw Privilege Escalation Vulnerability

CVE-2026-56694 Overview

CVE-2026-56694 is a privilege escalation vulnerability in NanoClaw versions prior to 2.1.0. The flaw resides in the channel-registration approval flow, specifically in the handleChannelApprovalResponse function. The handler fails to validate whether the responding admin holds privileges over the target agent group. Scoped admins can submit forged or stale connect callback values to bind messaging channels into agent groups outside their authorized scope. This exposes restricted agent groups to unapproved channels and enables unauthorized observation or control of agent activity. The weakness is classified under [CWE-863] Incorrect Authorization.

Critical Impact
A scoped admin can wire messaging channels into out-of-scope agent groups, gaining unauthorized visibility or control over restricted agent group communications.

Affected Products

NanoClaw versions prior to 2.1.0
NanoClaw channel-registration approval module (src/modules/permissions/channel-approval.ts)
NanoClaw permissions index handler (src/modules/permissions/index.ts)

Discovery Timeline

2026-06-23 - CVE-2026-56694 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56694

Vulnerability Analysis

The vulnerability stems from missing authorization checks during the channel approval response flow. NanoClaw uses an approval workflow where admins approve messaging channel registrations against agent groups. The handleChannelApprovalResponse handler accepts a connect callback value identifying the target agent group. The handler does not verify the responder's administrative privileges over that group. A scoped admin can therefore submit forged or replayed callback values referencing agent groups outside their scope. The approval is accepted, and the channel is wired into the out-of-scope group. This grants the attacker unauthorized read or control access to messaging activity within restricted groups, breaking the multi-tenant authorization model.

Root Cause

The root cause is the absence of a target-side authorization check in the approval response handler. The pre-patch code generated agent selection options from all available agent groups without scoping the list to the approver. The handler trusted the callback value supplied by the client rather than re-validating it against the approver's role assignments.

Attack Vector

Exploitation requires network access and low-privileged admin credentials. The attacker crafts or replays a connect callback value naming an agent group outside their scope. Submitting this through the approval flow causes the channel to be bound to the unauthorized group. No user interaction beyond the attacker's own admin session is required.

typescript

// Patch in src/modules/permissions/channel-approval.ts
 import type { AgentGroup } from '../../types.js';
 import { pickApprovalDelivery, pickApprover } from '../approvals/primitive.js';
 import { createPendingChannelApproval, hasInFlightChannelApproval } from './db/pending-channel-approvals.js';
+import { hasAdminPrivilege } from './db/user-roles.js';

 // ── Value constants (response handler in index.ts parses these) ──

typescript

// Patch in src/modules/permissions/index.ts
     if (!adapter) return true;

     const agentGroups = getAllAgentGroups();
-    const options = buildAgentSelectionOptions(agentGroups);
+    const options = buildAgentSelectionOptions(agentGroups, approverId);
     const title = '📋 Choose an agent';
     updatePendingChannelApprovalCard(row.messaging_group_id, title, JSON.stringify(options));

Source: GitHub Commit 0eef8fa. The fix introduces hasAdminPrivilege checks and passes approverId to buildAgentSelectionOptions so that only in-scope agent groups are presented and accepted during approval.

Detection Methods for CVE-2026-56694

Indicators of Compromise

Channel approval events where the approving admin's role scope does not include the target agent group ID in audit logs.
Messaging channels registered to agent groups that have no overlapping admin between approver and group owner.
Repeated approval callback submissions referencing varying or non-sequential agent group identifiers from the same admin session.

Detection Strategies

Audit the application's approval log for handleChannelApprovalResponse invocations and correlate approverId with the target agentGroupId against the role-assignment table.
Compare pre- and post-deployment baselines of channel-to-agent-group bindings to identify unauthorized wiring introduced before patching.
Inspect any pending channel approval records created prior to upgrading to 2.1.0 for callback values inconsistent with the approver's scope.

Monitoring Recommendations

Enable verbose logging on the NanoClaw permissions module and forward events to a centralized log platform for correlation.
Alert on approval responses where the callback-supplied agent group ID was not present in the approver's selection options view.
Track NanoClaw version inventory and flag instances running below 2.1.0 for prioritized remediation.

How to Mitigate CVE-2026-56694

Immediate Actions Required

Upgrade NanoClaw to version 2.1.0 or later, which introduces the hasAdminPrivilege authorization check.
Review existing channel-to-agent-group bindings and revoke any registrations approved by admins lacking scope over the target group.
Rotate or invalidate outstanding pending channel approval records created on vulnerable versions.

Patch Information

The fix is delivered in GitHub Pull Request #2566 and merged in commit 0eef8fa. The patch imports hasAdminPrivilege into channel-approval.ts and modifies buildAgentSelectionOptions in index.ts to scope agent group options to the approverId. Additional context is available in the VulnCheck Privilege Escalation Advisory.

Workarounds

Restrict admin role assignments so that scoped admins cannot reach the channel approval endpoint until the upgrade is applied.
Place a reverse proxy or application-layer filter in front of NanoClaw to inspect approval callbacks and reject submissions referencing agent groups outside the authenticated admin's scope.
Disable the channel-registration approval flow entirely in environments where it is not actively used until the patched version is deployed.

bash

# Upgrade NanoClaw to the patched release
npm install nanoclaw@2.1.0
# Verify the installed version
npm list nanoclaw | grep nanoclaw@