EUVD-2026-87697
GHSA-5cqx-93pc-jr85
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as ordinary ClawHub user
-
DeliveryCall skills:generateChangelogPreview for unauthorized skill
-
ExploitMissing file-read authz check bypassed
-
ExecutionRestricted prior version read and sent to AI provider
-
ImpactRead up to 8,000 chars of skill content in preview
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid signed-in ClawHub account (PR:L) able to invoke the public skills:generateChangelogPreview action; no user interaction, no special network position, and no non-default configuration are needed against an unpatched instance. Exploitation is limited to reading (confidentiality only) up to 8,000 characters of a skill's previous version per preview call, and only for skills that possess a prior version to preview. The hosted clawhub.ai service is no longer exploitable after the 2026-09-11 deployment; realistic remaining exposure is self-hosted deployments on a revision at or after cbfee7343ddc but before 8c2de6c506bb. The separate npm CLI and OpenClaw runtime products are not affected. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, score 7.1) describes a network-reachable, low-complexity attack that requires low privileges (PR:L, i.e. any signed-in account) and no user interaction, with high confidentiality impact but no integrity or availability impact - an accurate profile for a read-only information-disclosure flaw. No EPSS score, no CISA KEV listing, and no public POC are provided, and there is no SSVC decision data. These signals together point to a genuine but bounded issue rather than an urgent mass-exploitation priority: it is trivially exploitable by any authenticated user but only leaks skill content the caller shouldn't see (up to 8,000 characters per preview), with no code execution, tampering, or service impact. The most important mitigating fact is that the hosted instance (clawhub.ai) was already patched on 2026-09-11, so residual risk is concentrated in self-hosted deployments running an unpatched revision. Note the input tag 'Authentication Bypass' conflicts with the CWE-862 (Missing Authorization) classification and the description - this is an authorization/IDOR-style flaw affecting an already-authenticated caller, not an authentication bypass; treat the tag as mislabeled. |
| Exploit ScenarioDerived | An attacker registers or already holds an ordinary signed-in ClawHub account and calls the public skills:generateChangelogPreview action against a skill they have no read access to. The action reads the previous version of that skill without enforcing the normal file-read authorization and returns up to 8,000 characters of the restricted content in the AI-generated changelog preview, disclosing private skill material. No public exploit code is identified at time of analysis, but exploitation requires only a valid account and a crafted action call. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Missing authorization enforcement in ClawHub's public skills:generateChangelogPreview action lets any signed-in caller preview the prior version of a skill they are not authorized to access, disclosing up to 8,000 characters of quarantined or otherwise restricted skill content per request. The issue is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N; independent CVSS 3.1 assessment 7.1 with confidentiality impact only) and requires nothing more than a valid ClawHub account - no user interaction, special network position, or non-default configuration - while impact is limited to reading content, with no integrity or availability effect. No public exploit code has been identified at time of analysis; the hosted clawhub.ai service was remediated by the 2026-09-11 deployment of revision 8c2de6c506bb, so realistic residual exposure is confined to self-hosted deployments built from revisions at or after cbfee7343ddc867316dd9b3de6fa8856730f9f41 and before that fix.
RemediationAI
Vendor-released patch: revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3682), which was deployed to clawhub.ai on 2026-09-11; self-hosted operators should update to that revision or any later descendant commit and redeploy their Convex functions, since hosted clawhub.ai users need take no action. If an immediate upgrade is not possible, the targeted compensating control is to disable or remove the skills:generateChangelogPreview action from the deployed backend, or to wrap it with the same file-read authorization check used by normal content access - the trade-off is loss of the changelog preview feature in the UI. Because exploitation requires an authenticated account, restricting account provisioning (disabling open self-signup and reviewing existing accounts) reduces exposure at the cost of blocking legitimate new users, and tightening skill visibility/quarantine handling limits the value of any leaked prior-version content while that control is in place. No POC is publicly identified and no KEV entry exists, so prioritization can follow standard patching rather than emergency response; the npm CLI and OpenClaw runtime do not require updates for this CVE. Details and the fix commit are at https://github.com/openclaw/clawhub/security/advisories/GHSA-g3jp-jj55-jrcr and https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClawHub (openclaw/clawhub) is a Convex-based Node.js/TypeScript application and backend that hosts and distributes skills; the flaw is a CWE-862 Missing Authorization defect in one server-side action rather than a memory-safety or injection issue. Normal skill content access in ClawHub enforces a file-read authorization check, but the changelog preview path (skills:generateChangelogPreview) reads a skill's previous version without applying that same check before forwarding content to the configured AI provider and reflecting the generated preview back to the caller; an authenticated user could therefore submit up to 8,000 characters of quarantined/restricted prior-version content for processing and see it in the response. The vulnerable component is identified by CPE cpe:2.3:a:openclaw:clawhub, confirming the backend/application as the affected artifact; the separate npm CLI and OpenClaw runtime are distinct products and are not affected. The exact historical affected range was not established - the issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 - and the fix in PR #3682 landed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650.
Know when Clawhub gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Any authenticated user can trigger it remotely with low complexity and no interaction (PR:L, AC:L, UI:N); it only discloses restricted content, so C:H and I:A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read authorization enforced on normal content access, and up to 8,000 characters of quarantined content may be submitted to the AI provider and reflected in the preview returned to the caller, disclosing restricted skill content. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3682, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Technical POC Analysis
CWE-862 (Missing Authorization), in the ClawHub application/backend (openclaw/clawhub).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ClawHub's skills:generateChangelogPreview action can expose up to 8,000 characters of restricted or quarantined skill content to any authenticated user, creating a confidentiality risk for organizations that host sensitive skills on self-managed deployments. The hosted clawhub.ai service is already remediated, so leadership should prioritize identifying and upgrading self-hosted instances to remove residual exposure. No public exploit code has been identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated acc
Quota exhaustion in the ClawHub backend (openclaw/clawhub) lets a remote, unauthenticated caller drain the single shared
Server-side request forgery in ClawHub's public profile preview allows unauthenticated remote attackers to supply an ima
An authenticated user who originally published a skill under an organization keeps effective control of it in ClawHub: t
Exploit-DB