CVE-2026-95815
HIGH
7,2
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,3
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: none
Description
AI Translation Available
OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.
532
Insertion of Sensitive Information into Log File
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
All platforms may be affected
https://github.com/openclaw/openclaw
https://github.com/openclaw/openclaw/blob/935c16b5e22fae3c7ff5fdee0b834d5e0077d…
https://github.com/openclaw/openclaw/commit/8361f3704dd5e151ff1325e62ff5de658b6…
https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295
https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-e…