CVE-2026-56402

Name of the Vulnerable Software and Affected Versions NanoClaw versions prior to 2.1.17

Description A privilege escalation issue exists in the handleApprovalsResponse() function. The system fails to verify the authorization of the responder role, allowing attackers who possess a valid questionId to approve or reject privileged actions, such as package installations, by submitting approval response payloads.

Recommendations Update to version 2.1.17 or later. As a temporary mitigation, restrict access to the handleApprovalsResponse() function to authorized users only.