CVE-2026-100603 in ClawHub
Summary
by MITRE • 09/26/2026
ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota counts only reports filed against visible targets, the same accounts can repeat the process against additional skills; official skills are not exempt. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. The fix (PR #3681) is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability in the ClawHub application backend represents a significant integrity failure within its skill moderation workflow, specifically exploiting the automated reporting mechanism designed to filter inappropriate content. This flaw allows authenticated users with ordinary privileges to manipulate the visibility of skills listed in the catalog by triggering an automatic hiding state without requiring any human moderator intervention or review process. The core technical issue lies in how the system calculates and enforces reporter quotas; because these quotas are only counted against reports filed for targets that are currently visible, attackers can exploit this logic to repeatedly submit reports against different skills until they reach a threshold that forces an automatic moderation action. This design oversight effectively bypasses the intended safety checks, allowing malicious actors to silence competitors or disrupt service availability through simple automated actions rather than legitimate abuse reporting.
From a technical perspective, the flaw enables four distinct authenticated accounts to coordinate their efforts to report a single visible skill, resulting in its immediate classification as hidden due to the moderationStatus flag being set without human oversight. This mechanism is not limited to third-party contributions; official skills maintained by the project itself are equally susceptible to this abuse vector, which undermines trust in the platform's curation process. The lack of exemption for official content suggests that the validation logic does not differentiate between user-generated and authoritative entries when applying moderation rules. Consequently, an attacker with access to multiple accounts can systematically target specific skills or even conduct broad campaigns against numerous items by cycling through targets once a quota is reset or exhausted, leading to potential denial of service conditions where legitimate resources become inaccessible to users despite being fully compliant with platform guidelines.
The operational impact of this vulnerability extends beyond simple content removal; it compromises the reliability and fairness of the ClawHub ecosystem. Users may lose access to critical tools or libraries due to coordinated malicious reporting campaigns, while maintainers face reputational damage if their skills are falsely flagged as violating community standards without recourse for immediate appeal. The ability to hide official skills is particularly damaging as it disrupts the core value proposition of the platform by removing trusted resources from circulation based on manipulated metrics rather than actual policy violations. This creates an environment where content visibility is determined by resource availability in terms of account creation and coordination efforts rather than merit or compliance, eroding user confidence in the moderation system's ability to protect legitimate content from false positives.
In terms of industry standard classifications, this vulnerability aligns with CWE-862 Missing Authorization, as authenticated users are able to perform actions that should require elevated privileges or specific moderator roles. It also relates to CWE-798 Use of Hard-coded Credentials if the account creation process is trivial, facilitating the multi-account coordination required for exploitation. From a threat modeling perspective using MITRE ATT&CK, this behavior falls under T1496 Resource Hijacking and potentially T1530 Data from Cloud Storage Object Exfiltration depending on how hidden skills are accessed or removed from public view, though primarily it represents an abuse of functionality that leads to availability impact. The attack vector is classified as local network adjacent if self-hosted but remote if deployed publicly, requiring authentication which makes it a medium-complexity exploit for determined adversaries with social engineering capabilities to acquire multiple accounts.
Mitigation strategies must focus on hardening the moderation logic and implementing stricter controls around account behavior and quota calculations. The primary remediation involves updating to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or any later descendant where PR #3681 has been integrated, which addresses the immediate flaw in the reporting flow. For organizations managing self-hosted deployments of ClawHub, applying this update is critical to restore proper moderation workflows and prevent further abuse. Additionally, long-term fixes should include implementing rate limiting based on user identity rather than just target visibility, introducing CAPTCHA challenges for high-volume report submissions, and requiring manual review thresholds before any automatic hiding actions are taken regardless of the number of reports received. These measures will ensure that content removal decisions remain under human control or require significantly more sophisticated coordination to exploit, thereby preserving the integrity and availability of skills within the catalog.