CVE-2026-100600 ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API

ClawHub the openclaw/clawhub application/backend does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance. A remote, unauthenticated caller can drain that shared allowance and thereby deny or degrade API...