CVE-2026-56692: NanoClaw Symlink-Following Vulnerability Allows Host File Disclosure

Technical summary

The vulnerability exists in NanoClaw's forwardAttachedFiles function, which validates attachment filenames through the isSafeAttachmentName function before executing fs.copyFileSync. This validation mechanism does not account for symlinks; it checks only the filename itself, not whether the path target is a symbolic link. When fs.copyFileSync follows the symlink without additional containment checks, a container-controlled agent can specify a symlink whose name passes validation but whose target points to sensitive host files, enabling arbitrary file read access. The flaw is classified as CWE-59 (Improper Link Resolution Before File Access).

Business impact

An attacker with control over a container agent can exfiltrate sensitive host-readable files, including configuration files, application secrets, credentials, or other confidential data. This information disclosure can facilitate secondary attacks, privilege escalation, or lateral movement within the infrastructure. Organizations using NanoClaw to orchestrate containerized workloads face exposure of data that should remain isolated between container and host boundaries.

Affected systems

NanoClaw versions prior to 2.1.17 are affected. The vulnerability requires the attacker to have the ability to control or influence a container agent's behavior, making it relevant primarily in multi-tenant or shared container environments where agents may be compromised or controlled by untrusted actors.

Exploitability

Exploitation requires local access (the vector shows AV:L) and low-privilege container agent control (PR:L). No user interaction is necessary (UI:N). An attacker with agency over a container agent can reliably craft a malicious attachment filename as a symlink to exploit this flaw. The attack is straightforward once the agent is compromised, but the initial compromise of the container agent itself is a prerequisite.

Remediation

Upgrade NanoClaw to version 2.1.17 or later. Organizations unable to upgrade immediately should review and restrict which container agents have permission to submit file attachments, and monitor host file system access patterns for suspicious symlink traversal attempts.

Patch guidance

Apply the upgrade to NanoClaw 2.1.17 or later as soon as possible. Verify the patch by checking the installed version and confirming that the forwardAttachedFiles function now includes symlink validation or uses safer file handling primitives (such as realpath resolution with containment checks). Test in a staging environment before production deployment to ensure compatibility with existing container orchestration workflows.

Detection guidance

Monitor for unusual symlink creation patterns within container agent working directories. Log and alert on fs.copyFileSync operations that involve symbolic links, especially when those symlinks resolve to paths outside the expected attachment directory. Examine host access logs for file reads from sensitive locations (etc, opt, home directories) that correlate with container agent activity. Network and process monitoring can flag exfiltration of file contents immediately after forwardAttachedFiles processing.

Why prioritize this

Although the CVSS score is moderate (5.5), the vulnerability represents a direct boundary violation in containerized environments. Information disclosure of host files can undermine the security model of container isolation and enable follow-on attacks. Prioritize patching in environments where untrusted or semi-trusted agents run, and defer in strictly controlled, single-tenant deployments with no agent compromise risk.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects high confidentiality impact (C:H) but no integrity or availability impact. Local access and low privilege are required, limiting the immediate threat scope. However, the ability to read arbitrary host files without authentication or user interaction elevates the concern for data protection and compliance.

Frequently asked questions