CVE-2026-56694 — NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privile…
Published: 2026-06-23 · CVSS: 5.3 · CVSS 4.0
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7