Medium severity · published Sep 22, 2026
CVE-2026-95815
OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OI
OpenClaw iOS · OpenClaw
before 2026.8.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95815
github.com
https://github.com/openclaw/openclaw
github.com
https://github.com/openclaw/openclaw/blob/935c16b5e22fae3c7ff5fdee0b834d5e0077d1f6/apps/ios/Sources/Model/NodeAppModel.swift#L10037-L10038
github.com
https://github.com/openclaw/openclaw/commit/8361f3704dd5e151ff1325e62ff5de658b6c62e6
github.com
https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295
www.vulncheck.com
https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-exposure-via-deep-link-url-logging