CVE-2026-95815 OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging
Attackers can extract bearer keys from diagnostic logs to forge deep links and submit agent requests without user confirmation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-95815?
CVE-2026-95815 is a high-severity vulnerability in OpenClaw iOS, published on 22 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.
Weakness: CWE-532
Which versions are affected by CVE-2026-95815?
How do I fix CVE-2026-95815?
Upgrade to a fixed version.
Is CVE-2026-95815 being exploited?
There is no known exploitation of CVE-2026-95815 in the wild and no public exploit code.
Sources
Also known as GHSA-5j57-84cx-r295, GHSA-wjj6-g7c3-q75f, MINI-239x-c674-8q95.