Threats tagged 'ghsa-6pqv-3767-3c4m'

CVE-2026-100600 is a resource allocation vulnerability in the openclaw clawhub backend where anonymous HTTP API requests share a single default quota. This allows unauthenticated remote attackers to exhaust the shared quota, causing denial or degradation of service for other users. Additionally, if the TRUST_FORWARDED_IPS option is enabled without proper authentication, attackers can spoof forwarded IP headers to evade rate limiting. The issue was fixed in a later revision by redirecting anonymous calls and enforcing authentication for identity assertions.