CVE-2026-100604: ClawHub Authentication Bypass via Former Publisher Skill Control
ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current organization privileges. An authenticated user who originally published an organization skill can therefore transfer, delete, or restore that skill — taking control of its trusted name and history — even after their organization privileges have been revoked or downgraded. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3680, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclaw/clawhubto a version that resolves this vulnerability.Patch 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
Event History
Frequently Asked Questions
Are users of the hosted clawhub.ai service still exposed?
The fix was deployed to clawhub.ai on 2026-09-11.
What access would an attacker need?
An attacker must be authenticated and must have originally published the organization-owned skill. Exploitation remains possible after that user's organization privileges have been revoked or downgraded.
Which deployments and products need remediation?
Self-hosted ClawHub deployments should update to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Can a deployment be conclusively cleared based on a historical version range?
No complete historical affected range was established. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, and the identified fix is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650.