CVE-2026-95815

high

Description

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.

References

https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-exposure-via-deep-link-url-logging

https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295

https://github.com/openclaw/openclaw/commit/8361f3704dd5e151ff1325e62ff5de658b6c62e6

https://github.com/openclaw/openclaw/blob/935c16b5e22fae3c7ff5fdee0b834d5e0077d1f6/apps/ios/Sources/Model/NodeAppModel.swift#L10037-L10038

https://github.com/openclaw/openclaw

Details

Source: Mitre, NVD

Published: 2026-09-22

Updated: 2026-09-24

Risk Information

CVSS v2

Base Score: 5.6

Vector: CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:N

Severity: Medium

CVSS v3

Base Score: 6.3

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Severity: Medium

CVSS v4

Base Score: 7.2

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.0016