CVE-2026-100551 OpenClaw iOS Control UI TLS Pin Enforcement Bypass
Attackers can bypass TLS pinning in the iOS Control UI to steal Gateway credentials, enabling unauthorized access to sensitive state and host tools.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-100551?
CVE-2026-100551 is a critical vulnerability in OpenClaw, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an attacker able to redirect the same host and port and present a different certificate that is accepted by iOS system trust can serve a replacement Control UI page; opening the Terminal or a session Dashboard then allows that page to read the injected Gateway token or password. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. This issue is fixed in 2026.8.11.
Weakness: CWE-295
Which versions are affected by CVE-2026-100551?
How do I fix CVE-2026-100551?
No fix has been published for CVE-2026-100551 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100551 being exploited?
There is no known exploitation of CVE-2026-100551 in the wild and no public exploit code.
Sources
Also known as GHSA-x265-jggq-9g8p.