CVE-2026-100603

ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota counts only reports filed against visible targets, the same accounts can repeat the process against additional skills; official skills are not exempt. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. The fix (PR #3681) is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

• CWE-799

• https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
• https://github.com/openclaw/clawhub/security/advisories/GHSA-5jj4-m8c9-gwcq
• https://www.vulncheck.com/advisories/clawhub-before-8c2de6c506-skill-hiding-via-coordinated-reports

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100598OpenClaw (npm package openclaw) before 2026.7.1 incorrectly …7.1
• CVE-2026-100599OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply th…8.8
• CVE-2026-10060A vulnerability has been found in TRENDnet TEW-432BRP 3.10B2…9.8
• CVE-2026-100600ClawHub (the openclaw/clawhub application/backend) does not …5.3
• CVE-2026-100601ClawHub (openclaw/clawhub) application/backend contains a se…5.3
• CVE-2026-100602ClawHub (openclaw/clawhub application/backend) contains a mi…6.5
• CVE-2026-100604ClawHub (openclaw/clawhub) contains an incorrect authorizati…5.4
• CVE-2026-100605Flowise through 3.1.4 contains missing route-level RBAC chec…7.1
• CVE-2026-100606Flowise through 3.1.4 (Enterprise/platform mode with SSO ena…7.7
• CVE-2026-100607Flowise through 3.1.4 resolves SSO and local-password users …7.7
• CVE-2026-100608Flowise through 3.1.4 does not enforce authorization on the …8.3
• CVE-2026-100609Flowise (npm packages `flowise` and `flowise-components`) th…6.8