Vulnerability in ClawHub Application Affecting Skill Moderation Flow

CVE-2026-100603

What is CVE-2026-100603?

The ClawHub application has a weakness in its skill report moderation process that allows four distinct authenticated users to report and automatically hide visible skills from the catalog without input from a moderator. This exploit leverages the quota system tied to visible reports, allowing the same accounts to continuously target additional skills, including official ones. A patch has been released, and all self-hosted deployments should update to version 8c2de6c506 or a later version to mitigate this risk.

References