CVE-2026-95815: OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging
OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw iOSto a version that resolves this vulnerability.Fixed in 2026.8.11
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenClaw iOS installations before 2026.8.11 are exposed if their diagnostic archives containing unified logs can be obtained by an attacker. The impact depends on whether those logs include persistent bearer keys that remain valid.
What does an attacker need to exploit it?
An attacker needs access to a diagnostic archive containing the logged deep-link URLs and an unrotated bearer key from those URLs. They can then replay the key in forged deep links to submit agent requests without local confirmation prompts.
What should be done if diagnostic archives may have been shared or exposed?
Update OpenClaw iOS to 2026.8.11 or later and treat bearer keys present in affected diagnostic archives as exposed. Rotate any such keys so captured values can no longer be replayed.
How can I determine whether my environment may be affected?
Identify OpenClaw iOS devices running versions before 2026.8.11 and review whether their diagnostic archives or unified logs were collected, shared, or otherwise accessible. Affected logs contain complete agent deep-link URLs, including persistent bearer keys, as public diagnostic data.