CVE-2026-19005
Full vulnerability record from the local CVENow database.
Description
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-06 07:16:29.583000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-19005",
"sourceIdentifier": "[email protected]",
"published": "2026-08-06T07:16:29.583",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Una vulnerabilidad fue detectada en nanocoai NanoClaw hasta la versión 2.0.64. Afectada es la función handleCreateAgent del archivo src/modules/agent-to-agent/create-agent.ts del componente Creación de Agente Hijo. Realizar una manipulación resulta en una gestión inadecuada de privilegios. La explotación remota del ataque es posible. El exploit ahora es público y puede ser utilizado. El proyecto fue informado del problema con antelación a través de un informe de incidencias, pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "nanocoai",
"product": "NanoClaw",
"cpes": [
"cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"Child-Agent Creation"
],
"versions": [
{
"version": "2.0.0",
"status": "affected"
},
{
"version": "2.0.1",
"status": "affected"
},
{
"version": "2.0.2",
"status": "affected"
},
{
"version": "2.0.3",
"status": "affected"
},
{
"version": "2.0.4",
"status": "affected"
},
{
"version": "2.0.5",
"status": "affected"
},
{
"version": "2.0.6",
"status": "affected"
},
{
"version": "2.0.7",
"status": "affected"
},
{
"version": "2.0.8",
"status": "affected"
},
{
"version": "2.0.9",
"status": "affected"
},
{
"version": "2.0.10",
"status": "affected"
},
{
"version": "2.0.11",
"status": "affected"
},
{
"version": "2.0.12",
"status": "affected"
},
{
"version": "2.0.13",
"status": "affected"
},
{
"version": "2.0.14",
"status": "affected"
},
{
"version": "2.0.15",
"status": "affected"
},
{
"version": "2.0.16",
"status": "affected"
},
{
"version": "2.0.17",
"status": "affected"
},
{
"version": "2.0.18",
"status": "affected"
},
{
"version": "2.0.19",
"status": "affected"
},
{
"version": "2.0.20",
"status": "affected"
},
{
"version": "2.0.21",
"status": "affected"
},
{
"version": "2.0.22",
"status": "affected"
},
{
"version": "2.0.23",
"status": "affected"
},
{
"version": "2.0.24",
"status": "affected"
},
{
"version": "2.0.25",
"status": "affected"
},
{
"version": "2.0.26",
"status": "affected"
},
{
"version": "2.0.27",
"status": "affected"
},
{
"version": "2.0.28",
"status": "affected"
},
{
"version": "2.0.29",
"status": "affected"
},
{
"version": "2.0.30",
"status": "affected"
},
{
"version": "2.0.31",
"status": "affected"
},
{
"version": "2.0.32",
"status": "affected"
},
{
"version": "2.0.33",
"status": "affected"
},
{
"version": "2.0.34",
"status": "affected"
},
{
"version": "2.0.35",
"status": "affected"
},
{
"version": "2.0.36",
"status": "affected"
},
{
"version": "2.0.37",
"status": "affected"
},
{
"version": "2.0.38",
"status": "affected"
},
{
"version": "2.0.39",
"status": "affected"
},
{
"version": "2.0.40",
"status": "affected"
},
{
"version": "2.0.41",
"status": "affected"
},
{
"version": "2.0.42",
"status": "affected"
},
{
"version": "2.0.43",
"status": "affected"
},
{
"version": "2.0.44",
"status": "affected"
},
{
"version": "2.0.45",
"status": "affected"
},
{
"version": "2.0.46",
"status": "affected"
},
{
"version": "2.0.47",
"status": "affected"
},
{
"version": "2.0.48",
"status": "affected"
},
{
"version": "2.0.49",
"status": "affected"
},
{
"version": "2.0.50",
"status": "affected"
},
{
"version": "2.0.51",
"status": "affected"
},
{
"version": "2.0.52",
"status": "affected"
},
{
"version": "2.0.53",
"status": "affected"
},
{
"version": "2.0.54",
"status": "affected"
},
{
"version": "2.0.55",
"status": "affected"
},
{
"version": "2.0.56",
"status": "affected"
},
{
"version": "2.0.57",
"status": "affected"
},
{
"version": "2.0.58",
"status": "affected"
},
{
"version": "2.0.59",
"status": "affected"
},
{
"version": "2.0.60",
"status": "affected"
},
{
"version": "2.0.61",
"status": "affected"
},
{
"version": "2.0.62",
"status": "affected"
},
{
"version": "2.0.63",
"status": "affected"
},
{
"version": "2.0.64",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-06T15:06:31.842982Z",
"id": "CVE-2026-19005",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-269"
}
]
}
],
"references": [
{
"url": "https://github.com/nanocoai/nanoclaw/",
"source": "[email protected]"
},
{
"url": "https://github.com/nanocoai/nanoclaw/issues/2807",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-19005",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/862638",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386386",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386386/cti",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/862638",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}