Information Disclosure Vulnerability in ClawHub by OpenClaw
CVE-2026-100602

7.1HIGH

Key Information:

Vendor

Openclaw

Status
Clawhub
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100602?

ClawHub, developed by OpenClaw, contains a significant authorization bypass flaw within its changelog preview feature. This vulnerability allows authenticated users to access the changelog of skills they are not authorized to view. When invoking the skills:generateChangelogPreview action, restricted content can leak up to 8,000 characters of sensitive data without proper file-read authorization. This issue compromises the security of skill content, as it exposes restricted information to unauthorized users. The vulnerability was identified in revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, and has been addressed in update PR #3682. Users are advised to deploy the fixed version available on clawhub.ai or update to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or its subsequent revisions.

Affected Version(s)

clawhub 0 < 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650

clawhub 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650

References

https://github.com/openclaw/clawhub/security/advisories/G...
vendor-advisory
https://github.com/openclaw/clawhub/commit/8c2de6c506bb4e...
patch
https://www.vulncheck.com/advisories/clawhub-changelog-pr...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.