CVE-2026-19005

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS v3 6.3 MEDIUM
CVSS v2.0 6.5 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/nanocoai/nanoclaw/
https://github.com/nanocoai/nanoclaw/issues/2807
https://vuldb.com/cve/CVE-2026-19005
https://vuldb.com/submit/862638
https://vuldb.com/vuln/386386
https://vuldb.com/vuln/386386/cti
https://vuldb.com/submit/862638

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-06 07:16

Updated : 2026-08-12 21:00

NVD link : CVE-2026-19005

Mitre link : CVE-2026-19005

CVE.ORG link : CVE-2026-19005

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

CWE-269

Improper Privilege Management

{"id": "CVE-2026-19005", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19005", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T15:06:31.842982Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*"], "vendor": "nanocoai", "modules": ["Child-Agent Creation"], "product": "NanoClaw", "versions": [{"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.0.2"}, {"status": "affected", "version": "2.0.3"}, {"status": "affected", "version": "2.0.4"}, {"status": "affected", "version": "2.0.5"}, {"status": "affected", "version": "2.0.6"}, {"status": "affected", "version": "2.0.7"}, {"status": "affected", "version": "2.0.8"}, {"status": "affected", "version": "2.0.9"}, {"status": "affected", "version": "2.0.10"}, {"status": "affected", "version": "2.0.11"}, {"status": "affected", "version": "2.0.12"}, {"status": "affected", "version": "2.0.13"}, {"status": "affected", "version": "2.0.14"}, {"status": "affected", "version": "2.0.15"}, {"status": "affected", "version": "2.0.16"}, {"status": "affected", "version": "2.0.17"}, {"status": "affected", "version": "2.0.18"}, {"status": "affected", "version": "2.0.19"}, {"status": "affected", "version": "2.0.20"}, {"status": "affected", "version": "2.0.21"}, {"status": "affected", "version": "2.0.22"}, {"status": "affected", "version": "2.0.23"}, {"status": "affected", "version": "2.0.24"}, {"status": "affected", "version": "2.0.25"}, {"status": "affected", "version": "2.0.26"}, {"status": "affected", "version": "2.0.27"}, {"status": "affected", "version": "2.0.28"}, {"status": "affected", "version": "2.0.29"}, {"status": "affected", "version": "2.0.30"}, {"status": "affected", "version": "2.0.31"}, {"status": "affected", "version": "2.0.32"}, {"status": "affected", "version": "2.0.33"}, {"status": "affected", "version": "2.0.34"}, {"status": "affected", "version": "2.0.35"}, {"status": "affected", "version": "2.0.36"}, {"status": "affected", "version": "2.0.37"}, {"status": "affected", "version": "2.0.38"}, {"status": "affected", "version": "2.0.39"}, {"status": "affected", "version": "2.0.40"}, {"status": "affected", "version": "2.0.41"}, {"status": "affected", "version": "2.0.42"}, {"status": "affected", "version": "2.0.43"}, {"status": "affected", "version": "2.0.44"}, {"status": "affected", "version": "2.0.45"}, {"status": "affected", "version": "2.0.46"}, {"status": "affected", "version": "2.0.47"}, {"status": "affected", "version": "2.0.48"}, {"status": "affected", "version": "2.0.49"}, {"status": "affected", "version": "2.0.50"}, {"status": "affected", "version": "2.0.51"}, {"status": "affected", "version": "2.0.52"}, {"status": "affected", "version": "2.0.53"}, {"status": "affected", "version": "2.0.54"}, {"status": "affected", "version": "2.0.55"}, {"status": "affected", "version": "2.0.56"}, {"status": "affected", "version": "2.0.57"}, {"status": "affected", "version": "2.0.58"}, {"status": "affected", "version": "2.0.59"}, {"status": "affected", "version": "2.0.60"}, {"status": "affected", "version": "2.0.61"}, {"status": "affected", "version": "2.0.62"}, {"status": "affected", "version": "2.0.63"}, {"status": "affected", "version": "2.0.64"}]}]}], "published": "2026-08-06T07:16:29.583", "references": [{"url": "https://github.com/nanocoai/nanoclaw/", "source": "cna@vuldb.com"}, {"url": "https://github.com/nanocoai/nanoclaw/issues/2807", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-19005", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/862638", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/386386", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/386386/cti", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/862638", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "lastModified": "2026-08-12T21:00:37.147", "sourceIdentifier": "cna@vuldb.com"}