CVE-2026-19005 PUBLISHED

nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management

Assigner: VulDB
Reserved: 05.08.2026 Published: 06.08.2026 Updated: 06.08.2026

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 5.3

Product Status

Vendor nanocoai
Product NanoClaw
Versions
  • Version 2.0.0 is affected
  • Version 2.0.1 is affected
  • Version 2.0.2 is affected
  • Version 2.0.3 is affected
  • Version 2.0.4 is affected
  • Version 2.0.5 is affected
  • Version 2.0.6 is affected
  • Version 2.0.7 is affected
  • Version 2.0.8 is affected
  • Version 2.0.9 is affected
  • Version 2.0.10 is affected
  • Version 2.0.11 is affected
  • Version 2.0.12 is affected
  • Version 2.0.13 is affected
  • Version 2.0.14 is affected
  • Version 2.0.15 is affected
  • Version 2.0.16 is affected
  • Version 2.0.17 is affected
  • Version 2.0.18 is affected
  • Version 2.0.19 is affected
  • Version 2.0.20 is affected
  • Version 2.0.21 is affected
  • Version 2.0.22 is affected
  • Version 2.0.23 is affected
  • Version 2.0.24 is affected
  • Version 2.0.25 is affected
  • Version 2.0.26 is affected
  • Version 2.0.27 is affected
  • Version 2.0.28 is affected
  • Version 2.0.29 is affected
  • Version 2.0.30 is affected
  • Version 2.0.31 is affected
  • Version 2.0.32 is affected
  • Version 2.0.33 is affected
  • Version 2.0.34 is affected
  • Version 2.0.35 is affected
  • Version 2.0.36 is affected
  • Version 2.0.37 is affected
  • Version 2.0.38 is affected
  • Version 2.0.39 is affected
  • Version 2.0.40 is affected
  • Version 2.0.41 is affected
  • Version 2.0.42 is affected
  • Version 2.0.43 is affected
  • Version 2.0.44 is affected
  • Version 2.0.45 is affected
  • Version 2.0.46 is affected
  • Version 2.0.47 is affected
  • Version 2.0.48 is affected
  • Version 2.0.49 is affected
  • Version 2.0.50 is affected
  • Version 2.0.51 is affected
  • Version 2.0.52 is affected
  • Version 2.0.53 is affected
  • Version 2.0.54 is affected
  • Version 2.0.55 is affected
  • Version 2.0.56 is affected
  • Version 2.0.57 is affected
  • Version 2.0.58 is affected
  • Version 2.0.59 is affected
  • Version 2.0.60 is affected
  • Version 2.0.61 is affected
  • Version 2.0.62 is affected
  • Version 2.0.63 is affected
  • Version 2.0.64 is affected

Credits

  • TrumpChen (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Improper Privilege Management CWE
  • Incorrect Privilege Assignment CWE