Executive Summary

CVE-2026-56692 is a vulnerability in NanoClaw versions before 2.1.17 where the forwardAttachedFiles function improperly handles symbolic links (symlinks). The host application validates attachment filenames using only a basic check (isSafeAttachmentName) but then copies files using fs.copyFileSync, which follows symlinks without verifying if the linked files are within a safe directory. This allows a malicious or compromised container-controlled agent to create symlinks that point to arbitrary host-readable files, causing the host to inadvertently disclose sensitive files by copying them during attachment forwarding.

The root cause is the lack of containment checks on symlinks, enabling directory traversal and arbitrary file read attacks. The vulnerability was fixed by adding strict path validation, rejecting symlinks, ensuring files are regular files within the expected directory, and skipping any files that fail these checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a malicious or compromised agent running inside a container to exfiltrate arbitrary files from the host system that it should not have access to. By exploiting the symlink following flaw, an attacker can trick the host into copying sensitive host-readable files into another agent's inbox, potentially exposing confidential data.

The impact includes unauthorized disclosure of sensitive information across trust boundaries without requiring user interaction beyond the initial compromise of an agent. This can lead to data breaches and compromise of host system confidentiality.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying symlinked files in the agent's outbox directory that could be exploited to exfiltrate host-readable files.

You can check for symbolic links in the relevant directories used by NanoClaw agents by running commands that find symlinks and verify file types.

• Use the command `find /path/to/agent/outbox -type l` to list all symbolic links in the outbox directory.
• Use `ls -l /path/to/agent/outbox` to visually inspect for symlinks (indicated by 'l' at the start of the permissions).
• Check if any symlink points outside the expected directory by resolving real paths with `readlink -f /path/to/symlink`.

Monitoring logs for warnings related to skipped symlinked attachments during forwarding can also help detect exploitation attempts, as the patched version logs such events.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade NanoClaw to version 2.1.17 or later, where the vulnerability has been fixed.

The fix includes rejecting symbolic links in forwarded attachments and enforcing strict path validation to prevent directory traversal and unauthorized file access.

• Update NanoClaw to version 2.1.17 or newer.
• Ensure that the agent's outbox directory is not a symbolic link and that all attachments are regular files within the expected directory.
• Review and apply patches that implement the `isPathInside` function and related filesystem checks as described in the security fix.

Additionally, monitor logs for warnings about skipped symlinked files to detect any attempts to exploit this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows malicious agents to exfiltrate arbitrary host-readable files by exploiting symlink following in the forwardAttachedFiles function. Such unauthorized disclosure of sensitive or personal data could lead to violations of data protection regulations like GDPR or HIPAA, which mandate strict controls on access to and protection of personal and sensitive information.

By enabling attackers to access files outside the intended directory boundaries without proper containment checks, the vulnerability undermines data confidentiality and integrity requirements essential for compliance with these standards.

The fix introduced in version 2.1.17, which enforces strict path validation and rejects symlinks, helps mitigate this risk and supports compliance efforts by preventing unauthorized file disclosure.

Useful 0 Not Useful 0