medium5.4
CVE-2026-56694
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to vali…
Impact
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.
Affected products
| Product | Affected versions |
|---|---|
| NanoClaw | before 2.1.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.