Is CVE-2026-100603 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100603 being exploited in the wild.

How severe is CVE-2026-100603?

Medium severity, with a CVSS score of 5.4, published 26 September 2026.

Which products and versions are affected?

Openclaw ClawHub up to revision cbfee7343ddc867316dd9b3de6fa8856730f9f41.

Is there a fix for CVE-2026-100603?

A patch was published on 2026-09-11: Patched revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100603 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100603?

Check whether you run Openclaw ClawHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100603: ClawHub application backend authorization bypass in skill report moderation

CVE-2026-100603 · Severity: medium · CVSS 5.4 · Published 2026-09-26

ClawHub is a platform for managing and sharing skills. Four coordinated ordinary user accounts can repeatedly report any skill—including official ones—to automatically hide them from the catalog without moderator review. An attacker could weaponize this to disrupt the availability and visibility of legitimate skills through distributed reporting.

Technologies: Openclaw ClawHub. Vendors: Openclaw.

Quick answers

Is CVE-2026-100603 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100603 being exploited in the wild.
How severe is CVE-2026-100603?: Medium severity, with a CVSS score of 5.4, published 26 September 2026.
Which products and versions are affected?: Openclaw ClawHub up to revision cbfee7343ddc867316dd9b3de6fa8856730f9f41.
Is there a fix for CVE-2026-100603?: A patch was published on 2026-09-11: Patched revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100603 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100603?: Check whether you run Openclaw ClawHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The skill report moderation flow fails to enforce adequate authorization controls and rate-limiting. Four distinct authenticated accounts can each file a report against a visible skill to trigger automatic hiding (moderationStatus: hidden); the reporter quota only counts reports against visible targets, allowing repetition against additional skills. The flaw was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 and patched in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3681).

Affected products

OpenClaw ClawHub up to revision cbfee7343ddc867316dd9b3de6fa8856730f9f41

Timeline

2026-09-11: disclosed: Fix merged in PR #3681 and deployed revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
2026-09-11: patched: Patched revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
2026-09-26: advisory: Public advisory released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.