Clawhub
Monthly
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated accounts push any visible skill to moderationStatus: hidden with no moderator in the loop, silently removing it from the catalog - and official/vendor-published skills are not exempt. Because the reporter quota only counts reports filed against currently-visible targets, the same four accounts can recycle the trick against additional skills, so the effect is repeatable catalog suppression rather than a one-off. Exploitation requires only ordinary authenticated users (CVSS vector PR:L, no moderator or admin role) and coordinated multi-account control; no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis. The vendor CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) is more severe than the independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, which correctly bounds the impact to catalog visibility (no data read, no code execution); affected deployments are self-hosted ClawHub at or before revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, while the npm CLI and OpenClaw runtime are separate products and are not affected.
Missing authorization enforcement in ClawHub's public skills:generateChangelogPreview action lets any signed-in caller preview the prior version of a skill they are not authorized to access, disclosing up to 8,000 characters of quarantined or otherwise restricted skill content per request. The issue is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N; independent CVSS 3.1 assessment 7.1 with confidentiality impact only) and requires nothing more than a valid ClawHub account - no user interaction, special network position, or non-default configuration - while impact is limited to reading content, with no integrity or availability effect. No public exploit code has been identified at time of analysis; the hosted clawhub.ai service was remediated by the 2026-09-11 deployment of revision 8c2de6c506bb, so realistic residual exposure is confined to self-hosted deployments built from revisions at or after cbfee7343ddc867316dd9b3de6fa8856730f9f41 and before that fix.
An authenticated user who originally published a skill under an organization keeps effective control of it in ClawHub: the application/backend stores that publisher's historical ownerUserId on the skill record, and the transfer, delete, and restore authorization paths trust that stale identity before checking the caller's current organization privileges. As a result, a user whose organization role has been revoked or downgraded can still transfer, delete, or restore the organization-owned skill they originally published, taking over or destroying its trusted name and history. Exploitation is bounded - the attacker must have been the legitimate original publisher of that specific org skill, so arbitrary skills cannot be targeted - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV, carries a moderate CVSS 5.3, and is fixed by an upstream commit already deployed to clawhub.ai on 2026-09-11. The npm CLI and the OpenClaw runtime are separate products and are not affected.
Server-side request forgery in ClawHub's public profile preview allows unauthenticated remote attackers to supply an image URL whose hostname passes the textual private-address check but whose DNS resolution points to an internal, loopback, or rebinding-controlled destination, causing the backend to issue outbound requests to attacker-chosen internal targets. The flaw affects self-hosted ClawHub (openclaw/clawhub) application/backend deployments at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 or unfixed ancestors; the hosted clawhub.ai instance was patched on 2026-09-11, so only unpatched self-hosted instances remain exposed, and the npm CLI and OpenClaw runtime are separate, unaffected products. No public exploit code and no CISA KEV entry were identified at time of analysis, and the reporting researcher demonstrated only a loopback listener connection - access to production internal services, credential disclosure, and code execution were not demonstrated.
Quota exhaustion in the ClawHub backend (openclaw/clawhub) lets a remote, unauthenticated caller drain the single shared default allowance that all direct anonymous HTTP API requests draw from, degrading or denying API access for unrelated anonymous visitors. Because anonymous requests are never bound to a trusted caller identity, there is no per-caller isolation to absorb the abuse; a secondary path exists when the non-default TRUST_FORWARDED_IPS option is enabled without an authenticated edge or proxy in front of the service, allowing forged forwarded-IP headers (such as X-Forwarded-For or CF-Connecting-IP) to select arbitrary quota identities and evade rate limiting. The issue is availability-only (no data read or write), was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 with the complete historical affected range left undetermined, and is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684); assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, no public exploit identified at time of analysis, and the npm CLI and OpenClaw runtime are separate products that are not affected.
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated accounts push any visible skill to moderationStatus: hidden with no moderator in the loop, silently removing it from the catalog - and official/vendor-published skills are not exempt. Because the reporter quota only counts reports filed against currently-visible targets, the same four accounts can recycle the trick against additional skills, so the effect is repeatable catalog suppression rather than a one-off. Exploitation requires only ordinary authenticated users (CVSS vector PR:L, no moderator or admin role) and coordinated multi-account control; no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis. The vendor CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) is more severe than the independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, which correctly bounds the impact to catalog visibility (no data read, no code execution); affected deployments are self-hosted ClawHub at or before revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, while the npm CLI and OpenClaw runtime are separate products and are not affected.
Missing authorization enforcement in ClawHub's public skills:generateChangelogPreview action lets any signed-in caller preview the prior version of a skill they are not authorized to access, disclosing up to 8,000 characters of quarantined or otherwise restricted skill content per request. The issue is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N; independent CVSS 3.1 assessment 7.1 with confidentiality impact only) and requires nothing more than a valid ClawHub account - no user interaction, special network position, or non-default configuration - while impact is limited to reading content, with no integrity or availability effect. No public exploit code has been identified at time of analysis; the hosted clawhub.ai service was remediated by the 2026-09-11 deployment of revision 8c2de6c506bb, so realistic residual exposure is confined to self-hosted deployments built from revisions at or after cbfee7343ddc867316dd9b3de6fa8856730f9f41 and before that fix.
An authenticated user who originally published a skill under an organization keeps effective control of it in ClawHub: the application/backend stores that publisher's historical ownerUserId on the skill record, and the transfer, delete, and restore authorization paths trust that stale identity before checking the caller's current organization privileges. As a result, a user whose organization role has been revoked or downgraded can still transfer, delete, or restore the organization-owned skill they originally published, taking over or destroying its trusted name and history. Exploitation is bounded - the attacker must have been the legitimate original publisher of that specific org skill, so arbitrary skills cannot be targeted - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV, carries a moderate CVSS 5.3, and is fixed by an upstream commit already deployed to clawhub.ai on 2026-09-11. The npm CLI and the OpenClaw runtime are separate products and are not affected.
Server-side request forgery in ClawHub's public profile preview allows unauthenticated remote attackers to supply an image URL whose hostname passes the textual private-address check but whose DNS resolution points to an internal, loopback, or rebinding-controlled destination, causing the backend to issue outbound requests to attacker-chosen internal targets. The flaw affects self-hosted ClawHub (openclaw/clawhub) application/backend deployments at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 or unfixed ancestors; the hosted clawhub.ai instance was patched on 2026-09-11, so only unpatched self-hosted instances remain exposed, and the npm CLI and OpenClaw runtime are separate, unaffected products. No public exploit code and no CISA KEV entry were identified at time of analysis, and the reporting researcher demonstrated only a loopback listener connection - access to production internal services, credential disclosure, and code execution were not demonstrated.
Quota exhaustion in the ClawHub backend (openclaw/clawhub) lets a remote, unauthenticated caller drain the single shared default allowance that all direct anonymous HTTP API requests draw from, degrading or denying API access for unrelated anonymous visitors. Because anonymous requests are never bound to a trusted caller identity, there is no per-caller isolation to absorb the abuse; a secondary path exists when the non-default TRUST_FORWARDED_IPS option is enabled without an authenticated edge or proxy in front of the service, allowing forged forwarded-IP headers (such as X-Forwarded-For or CF-Connecting-IP) to select arbitrary quota identities and evade rate limiting. The issue is availability-only (no data read or write), was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 with the complete historical affected range left undetermined, and is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684); assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, no public exploit identified at time of analysis, and the npm CLI and OpenClaw runtime are separate products that are not affected.