CVE-2026-95815

MEDIUM 6.3

OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.

CWE	CWE-532
Vendor	openclaw
Product	openclaw ios
Published	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for openclaw openclaw ios

Be the first to know when new medium vulnerabilities affecting openclaw openclaw ios are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

OpenClaw / OpenClaw iOS

0 < 2026.8.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295 github.com: https://github.com/openclaw/openclaw/commit/8361f3704dd5e151ff1325e62ff5de658b6c62e6 github.com: https://github.com/openclaw/openclaw/blob/935c16b5e22fae3c7ff5fdee0b834d5e0077d1f6/apps/ios/Sources/Model/NodeAppModel.swift#L10037-L10038 github.com: https://github.com/openclaw/openclaw vulncheck.com: https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-exposure-via-deep-link-url-logging

Credits

Jason O'Neal (jason-allen-oneal)