CVE-2026-100602 in ClawHub
Summary
by MITRE • 09/26/2026
ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read authorization enforced on normal content access, and up to 8,000 characters of quarantined content may be submitted to the AI provider and reflected in the preview returned to the caller, disclosing restricted skill content. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3682, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The ClawHub application backend, specifically within the openclaw/clawhub repository, contains a critical missing authorization check in its changelog preview functionality. This vulnerability allows authenticated users to bypass access controls intended for restricted skill content. The flaw resides in the public skills:generateChangelogPreview action, which is designed to generate previews of changes made to software packages or skills hosted on the platform. Under normal circumstances, accessing specific files within a skill requires explicit file-read authorization permissions tied to the user's role and the resource's access control list. However, the changelog preview feature fails to enforce these same security checks when retrieving previous versions of content for comparison purposes.
An attacker who has valid credentials can invoke this endpoint with parameters targeting skills they do not have permission to view or modify. Because the authorization logic is absent in this specific code path, the system retrieves historical data from quarantined or restricted areas without validating whether the requesting user should have access to that information. The vulnerability specifically impacts up to 8,000 characters of content per request. This limit suggests a potential buffer constraint but does not mitigate the core issue of unauthorized disclosure. The retrieved content is then processed by an AI provider and returned in the preview response, effectively leaking sensitive internal logic, configuration details, or proprietary code that was intended to remain private to authorized maintainers or administrators.
From a technical perspective, this represents a classic Broken Access Control vulnerability where authentication succeeds but authorization fails for specific resources. The operational impact includes the potential exposure of intellectual property, security configurations, and other confidential data embedded within skill changelogs. This could facilitate further attacks by providing attackers with insights into internal architectures or hardcoded secrets that might be referenced in change logs over time. Such information leakage undermines the trust model of the platform and violates principles of least privilege essential for secure software development environments.
This issue aligns with CWE-269, Improper Privilege Management, as it involves a failure to enforce proper access control policies during resource retrieval. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, since the exploitation relies on legitimate credentials being used in an unauthorized manner to access restricted data through a misconfigured API endpoint. The vulnerability was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 and has been remediated by pull request #3682, which is included in commit 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650. This fix was deployed to the clawhub.ai service on September 11, 2026.
To mitigate this risk, administrators of self-hosted ClawHub deployments must update their instances to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or any later descendant that includes the authorization fix. It is important to note that this vulnerability does not affect the npm CLI tooling nor the OpenClaw runtime environment, as they are separate products with distinct codebases and security models. Organizations should verify their deployment versions immediately upon upgrading and audit logs for any potential exploitation attempts prior to patching. Regular security audits of API endpoints, particularly those involving data retrieval from restricted areas, are recommended to prevent similar authorization bypasses in the future.