CVE-2026-100581

MEDIUMCVSS 5.5

Description

OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operator authority.

Timeline

Published:September 26th, 2026 3:17 AM

Last modified:September 30th, 2026 1:16 AM

CVSS Scoring

CVSS v3: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-312

References & Reports

Advisories, patches, and third-party reports

https://github.com/openclaw/openclaw/security/advisories/GHSA-gcm4-fmcp-2f9r
https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-storage-via-share-extension

Source: NIST NVD · Data may lag official sources by up to one minute