# CVE-2026-100600: ClawHub anonymous API quota exhaustion and identity spoofing

Source: https://junglewise.ai/threats/cve-2026-100600-clawhub-the-openclaw-clawhub-application-backend-does-not-bind  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100600 · Severity: medium · CVSS 5.3 · Published 2026-09-26

ClawHub is a backend application that serves API requests with rate limiting. The vulnerability allows unauthenticated users to drain the shared quota pool used by all anonymous API callers, causing denial or degradation of service for unrelated visitors. Additionally, when a legacy trust setting is enabled without proper edge authentication, attackers can forge caller identity headers to select arbitrary quota limits and bypass rate limiting entirely.

Technologies: [Openclaw ClawHub](https://junglewise.ai/threats/technologies/clawhub). Vendors: [Openclaw](https://junglewise.ai/threats/vendors/openclaw).

## Quick answers

**Is CVE-2026-100600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100600 being exploited in the wild.

**How severe is CVE-2026-100600?** Medium severity, with a CVSS score of 5.3, published 26 September 2026.

**Which products and versions are affected?** Openclaw ClawHub cbfee7343ddc867316dd9b3de6fa8856730f9f41 and earlier (exact range not fully established); fixed in 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650.

**Is there a fix for CVE-2026-100600?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100600 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100600?** Check whether you run Openclaw ClawHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The API backend fails to bind anonymous HTTP requests to individual trusted identities, instead sharing a single default quota allowance across all unauthenticated callers (CWE-770). When the TRUST_FORWARDED_IPS option is enabled without an authenticated edge/proxy, clients can supply arbitrary forwarded IP headers to select quota identities, bypassing per-caller rate limits. The vulnerability is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684), where direct anonymous calls are redirected to the public API origin without consuming quota and forged identity assertions return HTTP 401.

## Affected products

- OpenClaw ClawHub cbfee7343ddc867316dd9b3de6fa8856730f9f41 and earlier (exact range not fully established); fixed in 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650

## Timeline

- 2026-09-11: disclosed: Fixed and deployed to clawhub.ai
- 2026-09-26: advisory: CVE-2026-100600 published

## References

- [https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650](https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650)
- [https://github.com/openclaw/clawhub/security/advisories/GHSA-4c7q-g7xf-5628](https://github.com/openclaw/clawhub/security/advisories/GHSA-4c7q-g7xf-5628)

## Related threats

- [ClawHub incorrect authorization in organization skill transfer](https://junglewise.ai/threats/cve-2026-100604-clawhub-openclaw-clawhub-contains-an-incorrect-authorization)
- [ClawHub application backend authorization bypass in skill report moderation](https://junglewise.ai/threats/cve-2026-100603-clawhub-openclaw-clawhub-application-backend-contains-a-flaw-in)
- [ClawHub missing authorization check in changelog preview](https://junglewise.ai/threats/cve-2026-100602-clawhub-openclaw-clawhub-application-backend-contains-a-missing)
- [ClawHub server-side request forgery in profile image preview](https://junglewise.ai/threats/cve-2026-100601-clawhub-openclaw-clawhub-application-backend-contains-a-server)