CVE-2026-56693: NanoClaw Privilege Escalation in Agent Container Confinement

Technical summary

The create_agent delivery-action handler in NanoClaw prior to 2.1.17 performs privileged database modifications to the central management system without enforcing host-side authorization checks. The vulnerability exists in CWE-602 (Client-Side Enforcement of Server-Side Security), meaning the system relies on client-side or container-side constraints rather than enforcing access control at the server level. A confined agent container can invoke create_agent to instantiate arbitrary agent groups, reconfigure container settings, and define new destinations, effectively escalating beyond its assigned confinement boundary. The flaw is reachable via local attack surface (AV:L), requires low complexity to exploit (AC:L), and demands only standard user privileges (PR:L) or the ability to run as the confined agent itself.

Business impact

This privilege escalation could allow a compromised or malicious agent container to break out of its sandbox and gain broader control over the NanoClaw deployment. An attacker exploiting this vulnerability can create unauthorized agents, redirect traffic to attacker-controlled destinations, and modify the configuration of other containers—actions that would normally require administrative approval. For organizations using NanoClaw for orchestration or multi-tenant agent management, this could lead to lateral movement within the infrastructure, unauthorized data exfiltration, or service disruption. The impact is heightened in environments where agent containers run partially untrusted or dynamically loaded code.

Affected systems

All versions of NanoClaw before 2.1.17 are affected. Organizations should inventory their NanoClaw deployments and determine current versions. The vulnerability requires an attacker to have local access and the ability to operate commands or code within a confined agent container, so the risk is highest in environments where agent containers execute untrusted workloads or where multiple tenants share infrastructure.

Exploitability

Exploitation requires local access (AV:L) and does not demand any special conditions or advanced techniques (AC:L). Any principal running within or with control over a confined agent container can invoke the vulnerable create_agent handler. No user interaction is needed. The attack surface is relatively narrow—limited to environments where confined agents exist and an attacker has already gained initial access—but the barrier to exploitation once inside is minimal. This is not a network-exploitable vulnerability, and it does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, though that does not rule out future exploitation.

Remediation

Upgrade NanoClaw to version 2.1.17 or later. Verify the upgrade path and test in a non-production environment first, as privilege escalation fixes may affect how confinement policies are enforced. In the interim, restrict which containers are permitted to invoke delivery-action handlers and review audit logs for any suspicious create_agent calls originating from confined containers. Apply network segmentation to limit the blast radius if an agent container is compromised.

Patch guidance

Apply NanoClaw version 2.1.17 or newer. Consult the vendor's release notes to confirm that this version includes the authorization check fixes for the create_agent handler. Schedule patching based on the criticality of your NanoClaw deployment; organizations running multi-tenant or high-sensitivity workloads should prioritize this update. Verify that all agent containers and management nodes are updated, as partial upgrades may leave legacy handlers vulnerable.

Detection guidance

Monitor logs for create_agent invocations originating from confined agent containers, particularly those that succeed without explicit administrative requests. Check for anomalous creation of new agent groups, unexpected container configuration changes, or new destination entries appearing in the central database. Audit the confinement policies and container roles to identify which principals should and should not have create_agent capability. Network-based detection is limited since this is a local vulnerability, but centralized logging of all delivery-action handler calls will reveal suspicious patterns.

Why prioritize this

This vulnerability merits prompt but measured attention. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local access requirement and lack of confidentiality impact, but the integrity risk is high—an attacker can modify critical configuration and create unauthorized agents. Prioritize patching in environments where agent containers run untrusted code, multi-tenant setups, or infrastructure handling sensitive data. Organizations running fully trusted, locked-down NanoClaw deployments with no untrusted workloads may defer patching slightly, but should still plan an upgrade within the next maintenance window.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects a vulnerability that requires an attacker to already be operating locally within or controlling a confined agent container. The local attack vector (AV:L) and low attack complexity (AC:L) indicate the exploit is straightforward once access is obtained. The need for low privileges (PR:L)—either as a standard user or the confined agent process itself—further constrains the attack surface. There is no confidentiality impact (C:N) and no availability impact (A:N), but the integrity impact is high (I:H) because an attacker can arbitrarily modify agent configurations, groups, and destinations. The scope is unchanged (S:U), meaning the attacker does not cross a security boundary in the traditional sense, but rather expands their privileges within the same host or container domain.

Frequently asked questions