ClawHub does not restrict anonymous API requests to a specific caller identity, so all such requests share a single default quota. A remote, unauthenticated attacker can consume this shared allowance by sending repeated anonymous requests, draining the quota and preventing or degrading access for legitimate users. When the TRUST_FORWARDED_IPS option is enabled without an authenticated proxy, the attacker can further tamper with forwarded IP headers to select quota identities, thereby evading rate limiting and consuming additional resources.

The vulnerability affects the openclaw/clawhub application. All revisions up to cbfee7343ddc867316dd9b3de6fa8856730f9f41 are potentially impacted. The issue was resolved in the commit 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which redirects direct anonymous calls to the public API origin without expending quota and rejects forged identity assertions with HTTP 401.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is unavailable, so the exploitation probability is unclear, and the vulnerability is not listed in CISA KEV. The likely attack vector is over the network to the anonymous API endpoint, requiring no authentication. An attacker can repeatedly send requests to exhaust the shared quota, and if configured with TRUST_FORWARDED_IPS, can bypass rate limits by forging IP headers.