CVE-2026-100600
Received Received - Intake

ClawHub API Quota Exhaustion via Unauthenticated Requests

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance. A remote, unauthenticated caller can drain that shared allowance and thereby deny or degrade API access for unrelated visitors. In addition, when the TRUST_FORWARDED_IPS option is enabled without an authenticated edge/proxy, clients can supply arbitrary forwarded IP headers to select quota identities of their choosing and evade rate limiting. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684), where direct anonymous calls are redirected to the public API origin without consuming quota and forged identity assertions return HTTP 401. The npm CLI and OpenClaw runtime are separate products and are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100600
EUVD
EUVD-2026-87695

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openclaw clawhub to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (inc)
openclaw clawhub to 8c2de6c506 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ClawHub's open API allows unauthenticated users to share a single quota allowance. This means remote attackers can consume the quota, blocking or slowing API access for legitimate users. If TRUST_FORWARDED_IPS is enabled without proper authentication, attackers can manipulate headers to bypass rate limits.

Impact Analysis

If you rely on ClawHub's API, attackers could degrade or deny service for all users by exhausting shared quotas. This may cause downtime, slow responses, or complete unavailability of the API for you and other users.

Mitigation Strategies

Update ClawHub to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or later to address the shared quota and forged identity issues. Disable the TRUST_FORWARDED_IPS option if enabled without proper authentication to prevent IP header manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart