CVE-2026-100604 in ClawHub
Summary
by MITRE • 09/26/2026
ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current organization privileges. An authenticated user who originally published an organization skill can therefore transfer, delete, or restore that skill — taking control of its trusted name and history — even after their organization privileges have been revoked or downgraded. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3680, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in ClawHub represents a critical failure in access control logic, specifically categorized under CWE-269: Improper Control of Interaction with an External Entity, though it fundamentally stems from CWE-862: Missing Authorization. The core technical flaw lies in the backend’s handling of skill ownership and lifecycle management within organization-owned repositories. When a user publishes a skill that is subsequently associated with or owned by an organization, the system retains the original publisher's userId as the definitive owner identifier for administrative actions such as transfer, deletion, or restoration. This design decision creates a persistent privilege escalation path because authorization checks rely on this historical ownership data rather than validating current organizational membership or role-based permissions against the active user context. Consequently, the security model assumes that the initial creator retains exclusive control over the asset regardless of subsequent changes in organizational structure or user status.
This architectural oversight allows an authenticated user who originally published a skill to retain full administrative control even after their privileges within the organization have been revoked, downgraded, or entirely removed from the system. An attacker leveraging this flaw can transfer ownership of trusted skills, delete critical assets, or restore previously deleted versions without possessing any current valid permissions in the target organization. The operational impact is severe as it enables unauthorized modification of software supply chain components that are likely integrated into automated development pipelines or production environments. By taking control of a skill’s name and history, an adversary can inject malicious code, disrupt service availability through deletion, or manipulate version histories to introduce vulnerabilities under the guise of legitimate updates. This undermines the integrity of the organization's dependency tree and compromises trust in the software supply chain managed by ClawHub.
The vulnerability was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, although the complete historical range of affected versions could not be fully established due to legacy data structures or migration complexities. Mitigation requires immediate action by administrators and users of ClawHub deployments. The issue has been resolved in PR #3680, which is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650. This fix was deployed to the public clawhub.ai instance on September 11, 2026. Self-hosted deployments must update their ClawHub backend to this specific revision or any later descendant that incorporates the same authorization logic corrections. It is important to note that while the vulnerability affects the ClawHub application and its associated backend services, the npm CLI tooling and the OpenClaw runtime environment are separate products and remain unaffected by this specific access control flaw. Organizations should verify their deployment versions immediately and ensure that all skill ownership records are audited for any lingering unauthorized administrative capabilities held by former employees or downgraded users.