CVE-2026-19005 | nanocoai NanoClaw up to 2.0.64 Child-Agent Creation create-agent.ts handleCreateAgent privileges management (Issue 2807)

A vulnerability classified as critical has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management.

This vulnerability is known as CVE-2026-19005. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.