CVE-2026-90807: NanoClaw SSRF Vulnerability

CVE-2026-90807 Overview

CVE-2026-90807 is a link following vulnerability [CWE-59] in nanocoai NanoClaw versions up to 2.1.17. The flaw resides in the forwardAttachedFiles function within src/modules/agent-to-agent/agent-route.ts, part of the Attachment Handler component. An attacker with low-level privileges can manipulate attachment handling to cause the application to follow crafted links, potentially accessing files outside intended boundaries. The exploit has been publicly disclosed, and the vendor has published a corrective patch identified by commit 3f9ed607b7e7a4872747295f75286f1c377d7c33. The attack can be performed remotely across a network.

Critical Impact
Remote low-privileged attackers can abuse symbolic link handling in the Attachment Handler to access unintended files during agent-to-agent file forwarding.

Affected Products

nanocoai NanoClaw versions up to and including 2.1.17
Component: Attachment Handler (src/modules/agent-to-agent/agent-route.ts)
Function: forwardAttachedFiles

Discovery Timeline

2026-09-14 - CVE-2026-90807 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90807

Vulnerability Analysis

The vulnerability is classified as a Link Following weakness [CWE-59], commonly referred to as a symbolic link (symlink) attack. The forwardAttachedFiles function in the Attachment Handler processes files during agent-to-agent message forwarding. Because the function does not properly resolve or validate link targets before opening files, an attacker can supply an attachment reference that points to a symbolic link. When the function follows that link, it operates on the linked target rather than the intended file, breaking the boundary the application assumes exists between user-controlled attachments and system resources.

Successful exploitation results in low-impact confidentiality, integrity, and availability effects. The requirement for low-level privileges limits scope to authenticated users of the NanoClaw agent runtime.

Root Cause

The root cause is missing validation of file link targets during attachment forwarding. The Attachment Handler trusts filesystem paths derived from attachment metadata and follows links without verifying that the resolved target remains within the expected working directory. This allows redirection of read or write operations to arbitrary filesystem locations reachable by the process.

Attack Vector

The attack is network-reachable and requires low privileges but no user interaction. An authenticated attacker crafts an attachment payload that references a symbolic link. When another agent forwards the attachment through forwardAttachedFiles, the application dereferences the link, exposing or modifying the linked file within the process's permission scope.

typescript

// Patch context from setup/auto.ts — commit 3f9ed607b7e7a4872747295f75286f1c377d7c33
       hint: note(prov.value, `${prov.hint} — installs now`),
     })),
   ];
+  // Only an explicit preset skips the picker (packaged flows). Every
+  // interactive install — fresh or re-run — is asked, so a non-Claude runtime
+  // is discoverable rather than something only a re-run with env vars reaches.
   const preset = process.env.NANOCLAW_AGENT_PROVIDER?.trim().toLowerCase();
-  // Fresh installs use Claude without another setup prompt. Explicit presets
-  // still win, and an existing non-Claude default keeps its provider picker.
-  const automatic = preset || (DEFAULT_AGENT_PROVIDER === 'claude' ? 'claude' : undefined);
-  if (automatic) {
-    if (!options.some((option) => option.value === automatic)) {
+  if (preset) {
+    if (!options.some((option) => option.value === preset)) {
       throw new Error(`NANOCLAW_AGENT_PROVIDER=${preset} is not available in this NanoClaw install`);
     }
-    setupLog.userInput('agent_provider', automatic);
-    phEmit('agent_provider_chosen', { provider: automatic, preset: Boolean(preset) });
-    return automatic;
+    setupLog.userInput('agent_provider', preset);
+    phEmit('agent_provider_chosen', { provider: preset, preset: true });
+    return preset;
   }

Source: GitHub Commit 3f9ed60

Detection Methods for CVE-2026-90807

Indicators of Compromise

Attachment forwarding events in NanoClaw logs referencing paths that resolve outside the expected attachment directory.
Filesystem access by the NanoClaw process to sensitive files not associated with any user attachment upload.
Presence of symbolic link files in attachment staging directories controlled by low-privileged users.

Detection Strategies

Enable audit logging on the NanoClaw process and inspect file open events triggered by forwardAttachedFiles for path traversal patterns or symlink dereferences.
Instrument the agent-to-agent route to log the resolved canonical path of each attachment before it is transmitted.
Correlate attachment upload identities with unusual file access patterns across agent runtime hosts.

Monitoring Recommendations

Monitor the running NanoClaw version and alert on any instance at or below 2.1.17.
Track outbound agent-to-agent messages that carry attachment payloads referencing absolute paths or paths containing .. traversal segments.
Baseline expected file paths accessed by the Attachment Handler and alert on deviations.

How to Mitigate CVE-2026-90807

Immediate Actions Required

Upgrade NanoClaw to the fixed release that contains commit 3f9ed607b7e7a4872747295f75286f1c377d7c33.
Audit the attachment staging directory for symbolic links introduced by low-privileged users and remove any that are not required.
Restrict which authenticated accounts are permitted to forward attachments between agents until the patch is applied.

Patch Information

The vendor patch is identified as commit 3f9ed607b7e7a4872747295f75286f1c377d7c33 in the nanocoai/nanoclaw GitHub repository. Additional context is available in GitHub Issue #2828 and the VulDB entry for CVE-2026-90807.

Workarounds

Run the NanoClaw process under a dedicated low-privilege service account whose filesystem permissions are limited to the attachment working directory.
Mount the attachment staging directory with the nosymfollow option, or on filesystems where that flag is unavailable, disable symbolic link creation for the service account.
Add pre-forward validation that canonicalizes attachment paths and rejects any path resolving outside the intended base directory.

bash

# Example: mount attachment staging directory without symlink following (Linux)
mount -o remount,nosymfollow /var/lib/nanoclaw/attachments

# Verify no symlinks exist in the staging directory
find /var/lib/nanoclaw/attachments -type l -ls