CVE-2026-100604

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100604
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100604.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100604
Aliases
  • GHSA-9558-q4f9-324f
Published
2026-09-26T13:22:48Z
Modified
2026-09-30T03:30:35Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
ClawHub Authentication Bypass via Former Publisher Skill Control
Details

ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current organization privileges. An authenticated user who originally published an organization skill can therefore transfer, delete, or restore that skill — taking control of its trusted name and history — even after their organization privileges have been revoked or downgraded. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3680, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100604.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/openclaw/clawhub

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/clawhub
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

Other
deploy/prod/20260502-194322Z-3aff30b
deploy/prod/20260502-194409Z-e4aa4c7
deploy/prod/20260502-194452Z-6d4cf0c
deploy/prod/20260502-200724Z-3c09df3
deploy/prod/20260502-200930Z-f2a61c9
deploy/prod/20260502-230014Z-8234c92
deploy/prod/20260503-055722Z-46354c9
deploy/prod/20260503-200652Z-768a501
deploy/prod/20260506-061139Z-32011a1
deploy/prod/20260506-062151Z-57308e6
deploy/prod/20260506-190528Z-5aa4d13
deploy/prod/20260506-191420Z-8d5eb14
deploy/prod/20260506-201213Z-bec9362
deploy/prod/20260506-211420Z-678935d
deploy/prod/20260506-211928Z-e8deec1
deploy/prod/20260507-001319Z-e629357
deploy/prod/20260507-003309Z-5019f2a
deploy/prod/20260507-024951Z-5e7797d
deploy/prod/20260509-085801Z-b6875e6
deploy/prod/20260509-114209Z-ceb2561
deploy/prod/20260509-124815Z-227cce1
deploy/prod/20260509-125130Z-da20972
deploy/prod/20260509-134242Z-8bd7be9
deploy/prod/20260509-135556Z-40627f0
deploy/prod/20260509-224311Z-4cfc137
deploy/prod/20260510-010329Z-edba7e1
deploy/prod/20260510-010750Z-49d77c0
deploy/prod/20260510-011225Z-3832305
deploy/prod/20260510-015432Z-3a6ab49
deploy/prod/20260510-042607Z-003d243
deploy/prod/20260510-055252Z-3b80e3f
deploy/prod/20260510-090040Z-c2c0130
deploy/prod/20260510-090717Z-92f5e68
deploy/prod/20260510-153112Z-3d934a5
deploy/prod/20260510-154121Z-2dcaf25
deploy/prod/20260511-003126Z-5d0264d
deploy/prod/20260511-074627Z-3173ecd
deploy/prod/20260511-132333Z-8287c49
deploy/prod/20260511-133638Z-a873ffb
deploy/prod/20260511-134807Z-3d021d3
deploy/prod/20260511-135611Z-bac981a
deploy/prod/20260511-150131Z-bb6c6c1
deploy/prod/20260511-211840Z-c51cfe2
deploy/prod/20260511-214020Z-008af4d
deploy/prod/20260511-224345Z-c1257a3
deploy/prod/20260511-225702Z-3b2d3dc
deploy/prod/20260511-232941Z-0c4d044
deploy/prod/20260512-000455Z-b80b942
deploy/prod/20260512-001645Z-53b64d1
deploy/prod/20260512-071923Z-dded7a5
deploy/prod/20260512-202256Z-af96221
deploy/prod/20260513-040344Z-f0a6789
deploy/prod/20260513-050836Z-72d4e7a
deploy/prod/20260513-073557Z-6c15a48
deploy/prod/20260513-095829Z-2763be8
deploy/prod/20260513-165224Z-a1666bb
deploy/prod/20260513-211620Z-a116d92
deploy/prod/20260513-223957Z-893f341
deploy/prod/20260513-225132Z-22e994f
deploy/prod/20260514-172640Z-cccef81
deploy/prod/20260514-182213Z-9ab92e5
deploy/prod/20260518-001045Z-636750f
deploy/prod/20260518-011348Z-35aa372
deploy/prod/20260518-233609Z-6814af9
deploy/prod/20260519-000431Z-583a48d
deploy/prod/20260519-010819Z-27f0b7d
deploy/prod/20260519-014538Z-66f3d07
deploy/prod/20260519-052642Z-4851f5f
deploy/prod/20260519-055850Z-c7935b6
deploy/prod/20260519-211813Z-0b888a2
deploy/prod/20260519-215421Z-b753b1f
deploy/prod/20260520-042436Z-3c45326
deploy/prod/20260520-050845Z-9be35a3
deploy/prod/20260520-224859Z-4e4d5c8
deploy/prod/20260521-030021Z-3910790
deploy/prod/20260521-152320Z-b07196f
deploy/prod/20260522-192443Z-e22bb7d
deploy/prod/20260522-194628Z-afd7326
deploy/prod/20260522-203624Z-0907fae
deploy/prod/20260523-185254Z-c145166
deploy/prod/20260523-223623Z-c538848
deploy/prod/20260523-234514Z-2ad4068
deploy/prod/20260524-004843Z-6a3c855
deploy/prod/20260524-015922Z-963b0a5
deploy/prod/20260525-230418Z-0194686
deploy/prod/20260525-235528Z-b62d8ca
deploy/prod/20260526-133223Z-90de729
deploy/prod/20260526-171147Z-667bc55
deploy/prod/20260527-170544Z-5ed0ddd
deploy/prod/20260527-172940Z-30bf8f2
deploy/prod/20260527-190912Z-57bc9f2
deploy/prod/20260527-195325Z-a920323
deploy/prod/20260527-223753Z-7d6efae
deploy/prod/20260528-141734Z-0132f1f
deploy/prod/20260528-153448Z-51967bc
deploy/prod/20260529-123902Z-cbbb6e7
deploy/prod/20260529-124423Z-b292f7e
deploy/prod/20260529-142403Z-23932ec
deploy/prod/20260529-184927Z-1f7f483
deploy/prod/20260529-200948Z-f71139e
deploy/prod/20260529-211834Z-4c965f4
deploy/prod/20260530-053946Z-9a20795
deploy/prod/20260530-171429Z-9aa3f37
deploy/prod/20260601-222719Z-01aa28c
deploy/prod/20260603-052159Z-0a79612
deploy/prod/20260603-072634Z-953358a
deploy/prod/20260603-214852Z-162528a
deploy/prod/20260604-231317Z-3fbe275
deploy/prod/20260605-012338Z-9cf9e12
deploy/prod/20260605-014234Z-7cd0ef3
deploy/prod/20260605-015059Z-1c8543a
deploy/prod/20260605-021742Z-fe4acc8
deploy/prod/20260605-032359Z-1a968d8
deploy/prod/20260605-040520Z-2d719fe
deploy/prod/20260605-215502Z-94ded18
deploy/prod/20260606-001730Z-8ebae39
deploy/prod/20260606-003339Z-d2525b1
deploy/prod/20260606-212428Z-9ce5e70
deploy/prod/20260606-215647Z-3ead985
deploy/prod/20260606-230930Z-999131e
deploy/prod/20260606-235826Z-8e1bad4
deploy/prod/20260608-033043Z-5c19da4
deploy/prod/20260608-055419Z-1fa4f90
deploy/prod/20260609-024445Z-be70ae5
deploy/prod/20260609-043208Z-89a89af
deploy/prod/20260609-222245Z-741599d
deploy/prod/20260610-035941Z-0724abc
deploy/prod/20260610-041125Z-e9571f3
deploy/prod/20260611-174907Z-2c9aa36
deploy/prod/20260612-001558Z-a1becd0
deploy/prod/20260612-233433Z-4b3c2bb
deploy/prod/20260613-213144Z-6820029
deploy/prod/20260613-213911Z-749028d
deploy/prod/20260613-224114Z-6afb91b
deploy/prod/20260614-203106Z-9ef3372
deploy/prod/20260614-230744Z-fdb4d31
deploy/prod/20260614-234854Z-b8ec008
deploy/prod/20260615-015847Z-03f9734
deploy/prod/20260615-034504Z-2293016
deploy/prod/20260615-061547Z-078d1c8
deploy/prod/20260615-163058Z-078425f
deploy/prod/20260615-163736Z-bb35aca
deploy/prod/20260615-180858Z-44ce895
deploy/prod/20260616-003524Z-89bb8fe
deploy/prod/20260616-003912Z-76638de
deploy/prod/20260616-005639Z-f366269
deploy/prod/20260616-011128Z-44f4ab0
deploy/prod/20260616-012408Z-69dd3b5
deploy/prod/20260616-030357Z-9115151
deploy/prod/20260616-030716Z-1b66b84
deploy/prod/20260616-150722Z-303075c
deploy/prod/20260616-153434Z-0e20d64
deploy/prod/20260617-000550Z-1e7de4a
deploy/prod/20260617-004422Z-4860945
deploy/prod/20260617-223349Z-11ad31a
deploy/prod/20260618-003024Z-2d93401
deploy/prod/20260618-010039Z-4bc58e4
deploy/prod/20260619-022924Z-1cac1b2
deploy/prod/20260619-204507Z-7accfb7
deploy/prod/20260619-220702Z-0f5496f
deploy/prod/20260620-003154Z-ea0125d
deploy/prod/20260620-023700Z-3836b76
deploy/prod/20260620-025932Z-6f28659
deploy/prod/20260622-005610Z-a86c48c
deploy/prod/20260622-043054Z-379c187
deploy/prod/20260622-071034Z-39d03a5
deploy/prod/20260623-044751Z-917fb3f
deploy/prod/20260623-053803Z-4a78ca3
deploy/prod/20260623-083226Z-94f2f53
deploy/prod/20260623-090710Z-6aab4f9
deploy/prod/20260623-095920Z-9b352d7
deploy/prod/20260623-183838Z-9b352d7
deploy/prod/20260623-221214Z-cc3fc61
deploy/prod/20260624-005758Z-32aa234
deploy/prod/20260624-020611Z-35f6d34
deploy/prod/20260624-042809Z-d3fa80c
deploy/prod/20260624-065233Z-2bf8113
deploy/prod/20260624-130548Z-fa222d4
deploy/prod/20260625-043053Z-e337136
deploy/prod/20260625-045900Z-8e7c8d4
deploy/prod/20260625-050530Z-d1716c6
deploy/prod/20260625-052841Z-843cf78
deploy/prod/20260625-063545Z-b5d1371
deploy/prod/20260625-074836Z-164959d
deploy/prod/20260625-081134Z-8e56a9f
deploy/prod/20260626-085018Z-a954bef
deploy/prod/20260626-231028Z-ce5455b
deploy/prod/20260627-003357Z-447a5b0
deploy/prod/20260627-142305Z-67b7403
deploy/prod/20260627-143554Z-18dac69
deploy/prod/20260627-160402Z-bdb23c3
deploy/prod/20260629-234306Z-aa5952e
deploy/prod/20260630-021601Z-a230d96
deploy/prod/20260630-024808Z-ab8e3b1
deploy/prod/20260630-052036Z-919f047
deploy/prod/20260702-151139Z-a89bfaf
deploy/prod/20260703-041442Z-3ce0ce4
deploy/prod/20260703-112333Z-9ff6fce
deploy/prod/20260706-113033Z-77c6671
deploy/prod/20260706-170529Z-2651570
deploy/prod/20260706-172312Z-1166a37
deploy/prod/20260706-173036Z-de19a6b
deploy/prod/20260706-205827Z-07e542f
deploy/prod/20260707-004945Z-fe7aab3
deploy/prod/20260707-234719Z-725af4e
deploy/prod/20260708-034250Z-6d27f3c
deploy/prod/20260709-035640Z-dfca6f5
deploy/prod/20260709-180850Z-de29369
deploy/prod/20260710-022008Z-2191194
deploy/prod/20260716-184139Z-b23d10d
deploy/prod/20260717-001110Z-97905c8
deploy/prod/20260717-003550Z-43e44a8
deploy/prod/20260717-185753Z-8142b35
deploy/prod/20260718-011339Z-af3d01c
deploy/prod/20260718-015627Z-db3b3fe
deploy/prod/20260720-072327Z-ed9c8fd
deploy/prod/20260720-230649Z-3097319
deploy/prod/20260721-023642Z-a68f707
deploy/prod/20260721-041248Z-8a8e692
deploy/prod/20260721-054036Z-723f155
deploy/prod/20260722-033423Z-7ef2b15
deploy/prod/20260722-050654Z-eb47a7c
deploy/prod/20260723-181221Z-eb3050f
deploy/prod/20260724-203241Z-ead9d94
deploy/prod/20260724-233949Z-fd61062
deploy/prod/20260726-174207Z-010c87f
deploy/prod/20260726-194300Z-c918f9f
deploy/prod/20260730-174302Z-70ce492
deploy/prod/20260802-053000Z-3d3ac29
deploy/prod/20260819-052709Z-d6ed957
deploy/prod/20260819-065811Z-bfb760d
deploy/prod/20260827-205813Z-efc565c
deploy/prod/20260831-042114Z-1643653
deploy/prod/20260831-175044Z-e2a82b3
deploy/prod/20260902-002915Z-251ef76
deploy/prod/20260902-114415Z-d405470
deploy/prod/20260904-232140Z-ba5eb72
deploy/prod/20260909-052907Z-494c348
gh-attach-assets
prod/v2026.*
prod/v2026.05.02.1
prod/v2026.05.02.2
prod/v2026.05.02.3
prod/v2026.05.02.4
prod/v2026.05.02.5
prod/v2026.05.02.6
prod/v2026.05.03.1
prod/v2026.05.03.2
prod/v2026.05.06.1
prod/v2026.05.06.2
prod/v2026.05.06.3
prod/v2026.05.06.4
prod/v2026.05.06.5
prod/v2026.05.06.6
prod/v2026.05.06.7
prod/v2026.05.07.1
prod/v2026.05.07.2
prod/v2026.05.07.3
prod/v2026.05.09.1
prod/v2026.05.09.2
prod/v2026.05.09.3
prod/v2026.05.09.4
prod/v2026.05.09.5
prod/v2026.05.09.6
prod/v2026.05.09.7
prod/v2026.05.10.1
prod/v2026.05.10.10
prod/v2026.05.10.2
prod/v2026.05.10.3
prod/v2026.05.10.4
prod/v2026.05.10.5
prod/v2026.05.10.6
prod/v2026.05.10.7
prod/v2026.05.10.8
prod/v2026.05.10.9
prod/v2026.05.11.1
prod/v2026.05.11.10
prod/v2026.05.11.11
prod/v2026.05.11.12
prod/v2026.05.11.2
prod/v2026.05.11.3
prod/v2026.05.11.4
prod/v2026.05.11.5
prod/v2026.05.11.6
prod/v2026.05.11.7
prod/v2026.05.11.8
prod/v2026.05.11.9
prod/v2026.05.12.1
prod/v2026.05.12.2
prod/v2026.05.12.3
prod/v2026.05.12.4
prod/v2026.05.13.1
prod/v2026.05.13.2
prod/v2026.05.13.3
prod/v2026.05.13.4
prod/v2026.05.13.5
prod/v2026.05.13.6
prod/v2026.05.13.7
prod/v2026.05.13.8
prod/v2026.05.14.1
prod/v2026.05.14.2
prod/v2026.05.18.1
prod/v2026.05.18.2
prod/v2026.05.18.3
prod/v2026.05.19.1
prod/v2026.05.19.2
prod/v2026.05.19.3
prod/v2026.05.19.4
prod/v2026.05.19.5
prod/v2026.05.19.6
prod/v2026.05.19.7
prod/v2026.05.20.1
prod/v2026.05.20.2
prod/v2026.05.20.3
prod/v2026.05.21.1
prod/v2026.05.21.2
prod/v2026.05.22.1
prod/v2026.05.22.2
prod/v2026.05.22.3
prod/v2026.05.23.1
prod/v2026.05.23.2
prod/v2026.05.23.3
prod/v2026.05.24.1
prod/v2026.05.24.2
prod/v2026.05.25.1
prod/v2026.05.25.2
prod/v2026.05.26.1
prod/v2026.05.26.2
prod/v2026.05.27.1
prod/v2026.05.27.2
prod/v2026.05.27.3
prod/v2026.05.27.4
prod/v2026.05.27.5
prod/v2026.05.28.1
prod/v2026.05.28.2
prod/v2026.05.29.1
prod/v2026.05.29.2
prod/v2026.05.29.3
prod/v2026.05.29.4
prod/v2026.05.29.5
prod/v2026.05.29.6
prod/v2026.05.30.1
prod/v2026.05.30.2
prod/v2026.06.01.1
prod/v2026.06.03.1
prod/v2026.06.03.2
prod/v2026.06.03.3
prod/v2026.06.04.1
prod/v2026.06.05.1
prod/v2026.06.05.2
prod/v2026.06.05.3
prod/v2026.06.05.4
prod/v2026.06.05.5
prod/v2026.06.05.6
prod/v2026.06.05.7
prod/v2026.06.06.1
prod/v2026.06.06.2
prod/v2026.06.06.3
prod/v2026.06.06.4
prod/v2026.06.06.5
prod/v2026.06.06.6
prod/v2026.06.08.1
prod/v2026.06.08.2
prod/v2026.06.09.1
prod/v2026.06.09.2
prod/v2026.06.09.3
prod/v2026.06.10.1
prod/v2026.06.10.2
prod/v2026.06.11.1
prod/v2026.06.12.1
prod/v2026.06.12.2
prod/v2026.06.13.1
prod/v2026.06.13.2
prod/v2026.06.13.3
prod/v2026.06.14.1
prod/v2026.06.14.2
prod/v2026.06.14.3
prod/v2026.06.15.1
prod/v2026.06.15.2
prod/v2026.06.15.3
prod/v2026.06.15.4
prod/v2026.06.15.5
prod/v2026.06.15.6
prod/v2026.06.16.1
prod/v2026.06.16.2
prod/v2026.06.16.3
prod/v2026.06.16.4
prod/v2026.06.16.5
prod/v2026.06.16.6
prod/v2026.06.16.7
prod/v2026.06.16.8
prod/v2026.06.16.9
prod/v2026.06.17.1
prod/v2026.06.17.2
prod/v2026.06.17.3
prod/v2026.06.18.1
prod/v2026.06.18.2
prod/v2026.06.19.1
prod/v2026.06.19.2
prod/v2026.06.19.3
prod/v2026.06.20.1
prod/v2026.06.20.2
prod/v2026.06.20.3
prod/v2026.06.22.1
prod/v2026.06.22.2
prod/v2026.06.22.3
prod/v2026.06.23.1
prod/v2026.06.23.2
prod/v2026.06.23.3
prod/v2026.06.23.4
prod/v2026.06.23.5
prod/v2026.06.23.6
prod/v2026.06.23.7
prod/v2026.06.24.1
prod/v2026.06.24.2
prod/v2026.06.24.3
prod/v2026.06.24.4
prod/v2026.06.24.5
prod/v2026.06.25.1
prod/v2026.06.25.2
prod/v2026.06.25.3
prod/v2026.06.25.4
prod/v2026.06.25.5
prod/v2026.06.25.6
prod/v2026.06.25.7
prod/v2026.06.26.1
prod/v2026.06.26.2
prod/v2026.06.27.1
prod/v2026.06.27.2
prod/v2026.06.27.3
prod/v2026.06.27.4
prod/v2026.06.29.1
prod/v2026.06.30.1
prod/v2026.06.30.2
prod/v2026.06.30.3
prod/v2026.07.02.1
prod/v2026.07.03.1
prod/v2026.07.03.2
prod/v2026.07.06.1
prod/v2026.07.06.2
prod/v2026.07.06.3
prod/v2026.07.06.4
prod/v2026.07.06.5
prod/v2026.07.07.1
prod/v2026.07.07.2
prod/v2026.07.08.1
prod/v2026.07.09.1
prod/v2026.07.09.2
prod/v2026.07.10.1
prod/v2026.07.16.1
prod/v2026.07.17.1
prod/v2026.07.17.2
prod/v2026.07.17.3
prod/v2026.07.18.1
prod/v2026.07.18.2
prod/v2026.07.20.1
prod/v2026.07.20.2
prod/v2026.07.21.1
prod/v2026.07.21.2
prod/v2026.07.21.3
prod/v2026.07.22.1
prod/v2026.07.22.2
prod/v2026.07.23.1
prod/v2026.07.24.1
prod/v2026.07.24.2
prod/v2026.07.26.1
prod/v2026.07.26.2
prod/v2026.07.30.1
prod/v2026.08.02.1
prod/v2026.08.19.1
prod/v2026.08.19.2
prod/v2026.08.27.1
prod/v2026.08.31.1
prod/v2026.08.31.2
prod/v2026.09.02.1
prod/v2026.09.02.2
prod/v2026.09.04.1
prod/v2026.09.09.1
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.1.0
v0.11.0
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.19.1
v0.19.2
v0.2.0
v0.20.0
v0.20.2
v0.21.0
v0.22.0
v0.23.0
v0.23.1
v0.23.2
v0.23.3
v0.3.0
v0.3.1-beta.1
v0.5.0
v0.6.0
v0.6.1
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100604.json"