CVE-2026-100603

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100601

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

CVE-2026-100602

ClawHub openclaw/clawhub application/backend contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read...

CVE-2026-100604

ClawHub openclaw/clawhub contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current...

CVE-2026-100600

ClawHub the openclaw/clawhub application/backend does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance. A remote, unauthenticated caller can drain that shared allowance and thereby deny or degrade API...

CVE-2026-100604 ClawHub Authentication Bypass via Former Publisher Skill Control

ClawHub openclaw/clawhub contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current...

EUVD-2026-87699

ClawHub openclaw/clawhub contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current...

CVE-2026-100604

The ClawHub application/backend contains an incorrect authorization vulnerability where organization-owned skills retain the ownerUserId of their original publisher. Because lifecycle and transfer checks trust this historical user instead of current organization privileges, an authenticated user ...

CVE-2026-100602

The ClawHub (openclaw/clawhub application/backend) software contains a missing authorization check in its changelog preview feature. A signed-in caller can exploit this to invoke the skills:generateChangelogPreview action for skills they are not authorized to access. This allows the attacker to b...

CVE-2026-100603

The ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow. Four distinct ordinary authenticated accounts can coordinate to report a visible skill, triggering its automatic hiding (moderationStatus: hidden) from the catalog without a moderator's decisio...

CVE-2026-100603 ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

EUVD-2026-87697

ClawHub openclaw/clawhub application/backend contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read...

EUVD-2026-87698

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100603 ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100602 ClawHub Changelog Preview Information Disclosure via Authorization Bypass

ClawHub openclaw/clawhub application/backend contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read...

CVE-2026-100602 ClawHub Changelog Preview Information Disclosure via Authorization Bypass

ClawHub openclaw/clawhub application/backend contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read...

CVE-2026-100601 ClawHub SSRF via Unchecked DNS Resolution in Profile Image

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

CVE-2026-100601 ClawHub SSRF via Unchecked DNS Resolution in Profile Image

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

EUVD-2026-87696

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

CVE-2026-100601

The ClawHub (openclaw/clawhub) application/backend is vulnerable to server-side request forgery (SSRF) within the public profile preview's image fetching functionality. The application accepts a user-supplied image URL and validates the textual hostname against private-address patterns but fails ...