CVE-2026-95815

HIGH 7.2 ALL-YEARS

Published 2026-09-22 · Last modified 2026-09-23 · VulnCheck · NVD: Deferred

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.

ELEVATED IMPACT

Severe if exploited (CVSS 7.2), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 5th percentile

○ In CISA KEV○ Public exploit / PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

7.2CVSS 4.0 · HIGH · CNA

ConfidentialityHigh
IntegrityHigh
AvailabilityNone

What an attacker needs

⚠Access: Requires local access to the host
✓Privileges: No account or privileges required
⚠User interaction: Succeeds with passive user activity
⚠Complexity: Needs a race window or specific setup
⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.

Affected

Vendors Openclaw

Products Openclaw Ios

Weakness (CWE)

CWE-532: Insertion of Sensitive Information into Log File

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

All CVSS metrics

HIGH 7.2 v4.0 · CNA Primary
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
MEDIUM 6.3 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
HIGH 7.2 v4.0 · NVD Secondary
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MEDIUM 6.3 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Sources: NVD · CVE.org · EPSS