CVE-2026-19005 - nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management

Back Back to CVE browser

MEDIUM

nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management

Published Aug 6, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.37%

Description

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor Nanocoai Product NanoClaw Default
n/a
- Version
  2.0.0
  Status
  affected
  Constraints
  -
- Version
  2.0.1
  Status
  affected
  Constraints
  -
- Version
  2.0.10
  Status
  affected
  Constraints
  -
- Version
  2.0.11
  Status
  affected
  Constraints
  -
- Version
  2.0.12
  Status
  affected
  Constraints
  -
- Version
  2.0.13
  Status
  affected
  Constraints
  -
- Version
  2.0.14
  Status
  affected
  Constraints
  -
- Version
  2.0.15
  Status
  affected
  Constraints
  -
- Version
  2.0.16
  Status
  affected
  Constraints
  -
- Version
  2.0.17
  Status
  affected
  Constraints
  -
- Version
  2.0.18
  Status
  affected
  Constraints
  -
- Version
  2.0.19
  Status
  affected
  Constraints
  -
- Version
  2.0.2
  Status
  affected
  Constraints
  -
- Version
  2.0.20
  Status
  affected
  Constraints
  -
- Version
  2.0.21
  Status
  affected
  Constraints
  -
- Version
  2.0.22
  Status
  affected
  Constraints
  -
- Version
  2.0.23
  Status
  affected
  Constraints
  -
- Version
  2.0.24
  Status
  affected
  Constraints
  -
- Version
  2.0.25
  Status
  affected
  Constraints
  -
- Version
  2.0.26
  Status
  affected
  Constraints
  -
- Version
  2.0.27
  Status
  affected
  Constraints
  -
- Version
  2.0.28
  Status
  affected
  Constraints
  -
- Version
  2.0.29
  Status
  affected
  Constraints
  -
- Version
  2.0.3
  Status
  affected
  Constraints
  -
- Version
  2.0.30
  Status
  affected
  Constraints
  -
- Version
  2.0.31
  Status
  affected
  Constraints
  -
- Version
  2.0.32
  Status
  affected
  Constraints
  -
- Version
  2.0.33
  Status
  affected
  Constraints
  -
- Version
  2.0.34
  Status
  affected
  Constraints
  -
- Version
  2.0.35
  Status
  affected
  Constraints
  -
- Version
  2.0.36
  Status
  affected
  Constraints
  -
- Version
  2.0.37
  Status
  affected
  Constraints
  -
- Version
  2.0.38
  Status
  affected
  Constraints
  -
- Version
  2.0.39
  Status
  affected
  Constraints
  -
- Version
  2.0.4
  Status
  affected
  Constraints
  -
- Version
  2.0.40
  Status
  affected
  Constraints
  -
- Version
  2.0.41
  Status
  affected
  Constraints
  -
- Version
  2.0.42
  Status
  affected
  Constraints
  -
- Version
  2.0.43
  Status
  affected
  Constraints
  -
- Version
  2.0.44
  Status
  affected
  Constraints
  -
- Version
  2.0.45
  Status
  affected
  Constraints
  -
- Version
  2.0.46
  Status
  affected
  Constraints
  -
- Version
  2.0.47
  Status
  affected
  Constraints
  -
- Version
  2.0.48
  Status
  affected
  Constraints
  -
- Version
  2.0.49
  Status
  affected
  Constraints
  -
- Version
  2.0.5
  Status
  affected
  Constraints
  -
- Version
  2.0.50
  Status
  affected
  Constraints
  -
- Version
  2.0.51
  Status
  affected
  Constraints
  -
- Version
  2.0.52
  Status
  affected
  Constraints
  -
- Version
  2.0.53
  Status
  affected
  Constraints
  -
- Version
  2.0.54
  Status
  affected
  Constraints
  -
- Version
  2.0.55
  Status
  affected
  Constraints
  -
- Version
  2.0.56
  Status
  affected
  Constraints
  -
- Version
  2.0.57
  Status
  affected
  Constraints
  -
- Version
  2.0.58
  Status
  affected
  Constraints
  -
- Version
  2.0.59
  Status
  affected
  Constraints
  -
- Version
  2.0.6
  Status
  affected
  Constraints
  -
- Version
  2.0.60
  Status
  affected
  Constraints
  -
- Version
  2.0.61
  Status
  affected
  Constraints
  -
- Version
  2.0.62
  Status
  affected
  Constraints
  -
- Version
  2.0.63
  Status
  affected
  Constraints
  -
- Version
  2.0.64
  Status
  affected
  Constraints
  -
- Version
  2.0.7
  Status
  affected
  Constraints
  -
- Version
  2.0.8
  Status
  affected
  Constraints
  -
- Version
  2.0.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nanocoai

NanoClaw

n/a

Version	Status	Constraints
2.0.0	affected	-
2.0.1	affected	-
2.0.10	affected	-
2.0.11	affected	-
2.0.12	affected	-
2.0.13	affected	-
2.0.14	affected	-
2.0.15	affected	-
2.0.16	affected	-
2.0.17	affected	-
2.0.18	affected	-
2.0.19	affected	-
2.0.2	affected	-
2.0.20	affected	-
2.0.21	affected	-
2.0.22	affected	-
2.0.23	affected	-
2.0.24	affected	-
2.0.25	affected	-
2.0.26	affected	-
2.0.27	affected	-
2.0.28	affected	-
2.0.29	affected	-
2.0.3	affected	-
2.0.30	affected	-
2.0.31	affected	-
2.0.32	affected	-
2.0.33	affected	-
2.0.34	affected	-
2.0.35	affected	-
2.0.36	affected	-
2.0.37	affected	-
2.0.38	affected	-
2.0.39	affected	-
2.0.4	affected	-
2.0.40	affected	-
2.0.41	affected	-
2.0.42	affected	-
2.0.43	affected	-
2.0.44	affected	-
2.0.45	affected	-
2.0.46	affected	-
2.0.47	affected	-
2.0.48	affected	-
2.0.49	affected	-
2.0.5	affected	-
2.0.50	affected	-
2.0.51	affected	-
2.0.52	affected	-
2.0.53	affected	-
2.0.54	affected	-
2.0.55	affected	-
2.0.56	affected	-
2.0.57	affected	-
2.0.58	affected	-
2.0.59	affected	-
2.0.6	affected	-
2.0.60	affected	-
2.0.61	affected	-
2.0.62	affected	-
2.0.63	affected	-
2.0.64	affected	-
2.0.7	affected	-
2.0.8	affected	-
2.0.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-269

Improper Privilege Management

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53717
Advisory
https://github.com/nanocoai/nanoclaw/
product
https://github.com/nanocoai/nanoclaw/issues/2807
exploitissue-tracking
https://vuldb.com/cve/CVE-2026-19005
third-party-advisory
https://vuldb.com/submit/862638
exploitthird-party-advisory
https://vuldb.com/vuln/386386
vdb-entrytechnical-description
https://vuldb.com/vuln/386386/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53717		Advisory
https://github.com/nanocoai/nanoclaw/		product
https://github.com/nanocoai/nanoclaw/issues/2807		exploitissue-tracking
https://vuldb.com/cve/CVE-2026-19005		third-party-advisory
https://vuldb.com/submit/862638		exploitthird-party-advisory
https://vuldb.com/vuln/386386		vdb-entrytechnical-description
https://vuldb.com/vuln/386386/cti		signaturepermissions-required