Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: openclaw clawhub 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 Clear all filters
TI-2026-64764 CVE-2026-100604 · GHSA-7q3h-63x4-wqwg

ClawHub Authentication Bypass via Former Publisher Skill Control

Priority LOW 24

ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle a…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-09-26 Fixed CWE-863
TI-2026-64763 CVE-2026-100603 · GHSA-xp39-g8px-67rv

ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

Priority LOW 37

ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus:…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00294 Published 2026-09-26 Fixed CWE-799
TI-2026-64761 CVE-2026-100601 · GHSA-c79c-3q26-rxxc

ClawHub SSRF via Unchecked DNS Resolution in Profile Image

Priority LOW 36

ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00328 Published 2026-09-26 Fixed CWE-918
TI-2026-64760 CVE-2026-100600 · GHSA-6pqv-3767-3c4m

ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API

Priority LOW 37

ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00371 Published 2026-09-26 Fixed CWE-770