VULNERABILITY INTELLIGENCE
CVE-2026-56694
CVSS score5.4 MEDIUM
EPSS probability0.29%
CISA KEVNot currently listed
Published2026-06-23
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.
Weakness classification
- disclosure@vulncheck.com: CWE-863