Quota Exhaustion Vulnerability in ClawHub by OpenClaw

CVE-2026-100600

What is CVE-2026-100600?

ClawHub, an application from OpenClaw, suffers from a vulnerability where anonymous HTTP API requests are not properly authenticated, resulting in a single shared quota allowance. This flaw allows an unauthenticated attacker to exhaust API limits, potentially leading to denial or degradation of service for legitimate users. Furthermore, when the TRUST_FORWARDED_IPS option is enabled without appropriate authentication, it exposes the system to further risks by enabling clients to manipulate forwarded IP headers, allowing them to bypass rate limiting controls. A fix has been implemented in the latest revision, which ensures that direct anonymous calls are redirected and unauthorized identity assertions result in access denial.

References