Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-100603: ClawHub lets four users hide skills without review
CVE-2026-100603 · published 18 days ago
Summary
The ClawHub service can be tricked by four normal accounts into removing a skill from the public catalog automatically, without any moderator approval. This can happen for any skill, including official ones, and the same accounts can repeat it for many skills. Update your self‑hosted ClawHub to the latest code revision (or later) to stop this behavior.
What to do
- Update openclaw clawhub to version 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openclaw | clawhub | < 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 |
Original advisory text
ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports
ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota counts only reports filed against visible targets, the same accounts can repeat the process against additional skills; official skills are not exempt. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. The fix (PR #3681) is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1006... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100603 Vendor Advisory
- https://www.vulncheck.com/advisories/clawhub-before-8c2de6c506-skill-hiding-via-...
- https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4...
- https://github.com/openclaw/clawhub/security/advisories/GHSA-5jj4-m8c9-gwcq
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.7
High
Type
CWE-799Improper Control of Interaction Frequency
Timeline
Published26 Sep 2026
Updated14 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100603 · NVD
CVE-2026-100603 · MITRE
CVE-2026-100603 · OSV
GHSA-5jj4-m8c9-gwcq · GHSA
Track software like this
Free during beta