CVE-2026-95815: OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-22 · updated 2026-09-24
Weakness: CWE-532

Description

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.

Affected products

OpenClaw iOS: before 2026.8.11 — fixed in 2026.8.11

How to fix

Upgrade to a fixed version: OpenClaw iOS 2026.8.11. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw
https://github.com/openclaw/openclaw/blob/935c16b5e22fae3c7ff5fdee0b834d5e0077d1f6/apps/ios/Sources/Model/NodeAppModel.swift#L10037-L10038
https://github.com/openclaw/openclaw/commit/8361f3704dd5e151ff1325e62ff5de658b6c62e6
https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295
https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-exposure-via-deep-link-url-logging

Get alerted when CVE-2026-95815 or the next vulnerability affects your stack