A serious flaw in NanoClaw could lead to file leakage from the environment where an AI agent is running. The vulnerability, documented as CVE-2026-18991, concerns the send_file and allows remote use of paths outside the intended directory.
The CVE entry states that NanoClaw versions 2.0.0 through 2.0.64 are affected. The issue is located in container/agent-runner/src/mcp-tools/core.ts, in the function that handles sending files to a messaging destination. The official CVE API describes the issue as path traversal and notes that an exploit has been publicly disclosed.
See also: JFrog Artifactory: 0-day chain detected by OpenAI models
How file leaks are caused
send_file accepts a path for the file to be sent. As reported in GitHub issue #2760, the function accepts both relative and absolute paths. Absolute paths are passed to the handler without checking that they remain within a trusted directory.
The file is then copied to the output folder and delivered as a regular attachment. The absence of whitelisting, path normalization, and constraint checking allows access to files that are visible inside the container. The result can be file leakage from shared folders, reports, or other data attached to the environment.
The report describes a scenario where a compromised or prompt injection-affected agent calls the tool with a file outside of /workspace/agent/. The file is transferred to the outbox and follows the normal sending flow, so the action may look like a legitimate attachment.
CVE-2026-18991 and risk rating
The listing gives the CVE a score of 7.3 with a CVSS of 3.1, in the High category, because the attack can be carried out remotely without prior authentication. At CVSS 4.0, the score is 6.9, which is classified as Medium. The difference reflects different methodologies, but both metrics indicate that the exposure should not be ignored.
The issue is not just a file display error. If credentials, internal references, or files from additional attachments are present in the same container, sending them to an external channel can impact the confidentiality of an installation. The extent depends on the agent's permissions and the folders that have been made available.
The peculiarity of NanoClaw is that AI agents operate inside containers, but isolation does not automatically protect every file attached to them. When a folder is made available to the agent for work purposes, incorrect path management can turn this convenience into a data extraction channel.
The scenario is particularly relevant for teams using agents with access to shared projects or automated message flows. It does not necessarily require the installation of new malware; it is enough to abuse a function that the agent already has, provided that its logic has been affected or it has been led astray by malicious instructions.
See also: CVE-2026-29059: Path traversal vulnerability in Windmill
Protection measures for NanoClaw installations
Until a suitable patch is confirmed, administrators should list installations running NanoClaw 2.0.64 or earlier. Access to the agent runner and dispatch channels should be restricted, and additional folders should be temporarily disconnected when not absolutely necessary.
The SecNews technical team also recommends checking logs for unusual calls to send_file, especially when the path points outside the expected workspace. It is a good idea to avoid placing secrets and credentials in folders visible to the agent and to apply network restrictions to outbound channels.
Controls should cover folder permissions, not just software version. Data segmentation, limited container access, and logging of every outgoing attachment reduce the likelihood of a major leak, even when an agent malfunctions.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The project changelog lists general security fixes to prevent symbolic link evasion and to limit functionality, but does not explicitly map these changes to CVE-2026-18991. Therefore, the availability of a fix must be confirmed by administrators before the service is restored.
This case shows that the security of an AI agent depends on the limits of its tools, not just on container isolation. Version confirmation, attachment restrictions, and dispatch monitoring are essential requirements until a fully patched version is clarified.
See also: Vibe Coding: AI applications show critical security vulnerabilities
