CVE-2026-100600: Allocation of Resources Without Limits or Throttling in openclaw clawhub
CVE-2026-100600 is a vulnerability in the openclaw clawhub backend where anonymous HTTP API requests share a single default quota, allowing unauthenticated remote attackers to exhaust this quota and degrade or deny API access for other users. Additionally, if the TRUST_FORWARDED_IPS option is enabled without proper authentication, attackers can spoof forwarded IP headers to evade rate limiting. The issue was fixed in a later revision by redirecting anonymous calls and enforcing authentication for identity assertions.
AI Analysis
Technical Summary
The openclaw clawhub application does not bind anonymous HTTP API requests to unique caller identities, causing all such requests to share a single quota allowance. This allows remote unauthenticated attackers to drain the shared quota, resulting in denial or degradation of service for legitimate users. When the TRUST_FORWARDED_IPS option is enabled without an authenticated proxy, attackers can supply arbitrary forwarded IP headers to select quota identities and bypass rate limiting. The vulnerability was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 and fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684). The fix involves redirecting anonymous calls to the public API origin without consuming quota and returning HTTP 401 for forged identity assertions. The npm CLI and OpenClaw runtime are not affected.
Potential Impact
An unauthenticated remote attacker can exhaust the shared quota for anonymous API requests, causing denial or degradation of service for other users relying on the clawhub API. Additionally, attackers can evade rate limiting by spoofing forwarded IP headers if TRUST_FORWARDED_IPS is enabled without proper authentication, further exacerbating the risk of quota exhaustion and service disruption.
Mitigation Recommendations
A fix is available and was implemented in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684). Users should upgrade to this revision or later to ensure anonymous calls are properly handled and quota exhaustion attacks are mitigated. The fix redirects anonymous calls to the public API origin without consuming quota and enforces authentication to prevent forged identity assertions. No additional mitigation is required if this fix is applied.
CVE-2026-100600: Allocation of Resources Without Limits or Throttling in openclaw clawhub
Description
CVE-2026-100600 is a vulnerability in the openclaw clawhub backend where anonymous HTTP API requests share a single default quota, allowing unauthenticated remote attackers to exhaust this quota and degrade or deny API access for other users. Additionally, if the TRUST_FORWARDED_IPS option is enabled without proper authentication, attackers can spoof forwarded IP headers to evade rate limiting. The issue was fixed in a later revision by redirecting anonymous calls and enforcing authentication for identity assertions.
CVSS v4.0
Score 6.9medium
Affected software
openclaw
clawhub
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The openclaw clawhub application does not bind anonymous HTTP API requests to unique caller identities, causing all such requests to share a single quota allowance. This allows remote unauthenticated attackers to drain the shared quota, resulting in denial or degradation of service for legitimate users. When the TRUST_FORWARDED_IPS option is enabled without an authenticated proxy, attackers can supply arbitrary forwarded IP headers to select quota identities and bypass rate limiting. The vulnerability was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 and fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684). The fix involves redirecting anonymous calls to the public API origin without consuming quota and returning HTTP 401 for forged identity assertions. The npm CLI and OpenClaw runtime are not affected.
Potential Impact
An unauthenticated remote attacker can exhaust the shared quota for anonymous API requests, causing denial or degradation of service for other users relying on the clawhub API. Additionally, attackers can evade rate limiting by spoofing forwarded IP headers if TRUST_FORWARDED_IPS is enabled without proper authentication, further exacerbating the risk of quota exhaustion and service disruption.
Mitigation Recommendations
A fix is available and was implemented in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684). Users should upgrade to this revision or later to ensure anonymous calls are properly handled and quota exhaustion attacks are mitigated. The fix redirects anonymous calls to the public API origin without consuming quota and enforces authentication to prevent forged identity assertions. No additional mitigation is required if this fix is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T01:04:47.561Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c99ff7a7c5410652fc9c
Added to database: 09/26/2026, 13:33:19 UTC
Last enriched: 09/26/2026, 14:33:07 UTC
Last updated: 09/26/2026, 15:27:52 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.