CVE-2026-95815highCWE-532

OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2

exploitation probability

—

observed exploitation

nono source reports it

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products

OpenClaw · OpenClaw iOS

References

https://github.com/openclaw/openclaw https://github.com/openclaw/openclaw/blob/935c16b5e22fae3c7ff5fdee0b834d5e0077d1f6/apps/ios/Sources/Model/NodeAppModel.swift#L10037-L10038 https://github.com/openclaw/openclaw/commit/8361f3704dd5e151ff1325e62ff5de658b6c62e6 https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295 https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-exposure-via-deep-link-url-logging