CVE-2026-18991

The CVSS 7.3 score for this path traversal in NanoClaw's containerized send_file function likely understates your actual exposure. Here's why and what to do about it. The vulnerability lets an attacker with network access to a NanoClaw agent read arbitrary files within the container's filesystem. In isolation, that's a local confidentiality issue — CVSS captures that correctly. But the container context changes everything. The attacker's real prize isn't the files inside the container. It's the credentials the container already has access to. If the NanoClaw agent runs with a Kubernetes service account that has RBAC permissions to list or get secrets (common in agent workloads that need to interact with cluster resources), a path traversal to /var/run/secrets/kubernetes.io/serviceaccount/ yields a valid service account token. That token can then be used to escalate to cluster-admin depending on the RBAC bindings — a classic container-to-cluster pivot. Even without elevated RBAC, if the container can reach the cloud metadata service at 169.254.169.254, the attacker can harvest IAM credentials, storage keys, or other cloud tokens. Many container runtimes don't restrict IMDS access by default, making this a trivially accessible second-order target. What you should do now: 1. Identify every deployment of NanoClaw agents in your clusters and determine what service account they run under. Run `kubectl get pod <pod> -o jsonpath='{.spec.serviceAccountName}'` for each. 2. Audit the RBAC bindings for those service accounts. If they have get, list, or watch on secrets, or any cluster-admin-equivalent role, you have a high-severity exposure. The path traversal bypasses access controls precisely because the container is already authenticated. 3. Block IMDS access at the container runtime or network level. For Kubernetes, add a NetworkPolicy that denies egress to 169.254.169.254/32. For AWS, disable IMDSv2 on the node or use a pod security policy that sets `metadata.httpTokens: required`. 4. Assume active exploitation. The CVE notes the vendor was notified and hasn't responded — there is no patch available and no timeline for one. Treat this as an incident until the vendor ships a fix. The CVSS scope metric should arguably be 'Changed' in this containerized context with elevated service account permissions, which would push the effective severity to 9.8. Regardless of the vector, prioritize the RBAC audit and IMDS lockdown immediately.

Reviewed through automated stages and approved by a human before publication.