CVE-2026-95815: OpenClaw iOS Information Disclosure Flaw

CVE-2026-95815 Overview

OpenClaw iOS versions before 2026.8.11 write complete agent deep-link URLs to Apple's unified logging system as public diagnostic data. These URLs contain persistent bearer keys that authenticate agent requests. An attacker who obtains a diagnostic archive from the device can extract unrotated keys and reuse them in forged deep links. The forged links submit agent requests without triggering the local confirmation prompt intended to gate sensitive actions. The weakness is tracked as insertion of sensitive information into log files [CWE-532].

Critical Impact
Bearer keys recovered from public log entries let an attacker forge deep links that bypass user confirmation and issue agent requests on behalf of the victim.

Affected Products

OpenClaw iOS application versions prior to 2026.8.11
Deep-link handler in apps/ios/Sources/Model/NodeAppModel.swift
Devices whose unified log archives (sysdiagnose) have been shared or exfiltrated

Discovery Timeline

2026-09-22 - CVE-2026-95815 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95815

Vulnerability Analysis

OpenClaw iOS handles agent invocations through custom URL schemes processed by handleAgentDeepLink. The handler logged the full originalURL.absoluteString with privacy: .public, forcing Apple's unified logging subsystem to persist the raw URL rather than redact it. Because the URL query string carries a persistent bearer key that authorizes agent requests, any consumer of the log stream can read a reusable credential. Diagnostic archives generated by sysdiagnose, MDM log collection, or crash-reporting utilities therefore expose live authentication material.

The local attack vector requires the attacker to obtain a diagnostic archive from the device or a system it was shared with. Once the bearer key is recovered, the attacker constructs a new deep link that presents the key as if the user had authorized the action. The application accepts the request and skips the confirmation UI that would normally require user interaction.

Root Cause

The root cause is a logging policy error: the developer marked the URL argument as public in a Logger call, which disables the default redaction Apple applies to interpolated values. Combined with a token design that relies on long-lived, unrotated bearer keys embedded in URLs, any log capture becomes a credential capture.

Attack Vector

Exploitation is local and requires user interaction to generate or share the diagnostic archive. An attacker who receives a support bundle, retrieves logs from a shared Mac via device pairing, or reads logs from an MDM console can parse the URL strings, isolate the bearer key parameter, and craft a new deep link. Opening that link on the victim device — for example through a webpage, QR code, or messaging app — triggers the agent action without the confirmation prompt.

swift

// Patched handler in apps/ios/Sources/Model/NodeAppModel.swift
 private func handleAgentDeepLink(_ link: AgentDeepLink, originalURL: URL) async {
     let message = link.message.trimmingCharacters(in: .whitespacesAndNewlines)
     guard !message.isEmpty else { return }
-    self.deepLinkLogger.info(
-        "agent deep link messageChars=\(message.count) url=\(originalURL.absoluteString, privacy: .public)")
+    self.deepLinkLogger.info("agent deep link messageChars=\(message.count, privacy: .public)")

     if message.count > IOSDeepLinkAgentPolicy.maxMessageChars {
         self.recordShareEvent("Rejected: message too large (\(message.count) chars).")

Source: OpenClaw GitHub Commit 8361f370. The patch removes the URL argument from the log statement and marks only the message length as public, so bearer keys never reach the unified log.

Detection Methods for CVE-2026-95815

Indicators of Compromise

Log entries in the deepLinkLogger subsystem containing agent deep link followed by a full url= value with query parameters
Sysdiagnose archives or MDM log exports that include OpenClaw URL scheme strings with bearer key parameters
Agent actions recorded in server-side telemetry that lack a corresponding user confirmation event on the device

Detection Strategies

Grep unified log exports for the OpenClaw URL scheme and any key=, token=, or bearer= parameter patterns to identify leaked credentials
Correlate agent request timestamps on the backend with device-side confirmation events; discrepancies indicate deep-link replay
Inventory installed OpenClaw iOS builds through MDM and flag versions below 2026.8.11

Monitoring Recommendations

Alert when diagnostic archives are generated on devices running vulnerable builds and route them through a controlled review workflow
Monitor backend agent APIs for repeated use of the same bearer key from new client fingerprints or IP addresses
Track deep-link invocation rates per device and surface spikes that could reflect scripted replay

How to Mitigate CVE-2026-95815

Immediate Actions Required

Upgrade every OpenClaw iOS install to version 2026.8.11 or later through the App Store or MDM push
Rotate all agent bearer keys issued to devices that ran affected versions, treating pre-patch keys as compromised
Purge or restrict access to sysdiagnose bundles and MDM log exports collected from vulnerable builds

Patch Information

The fix is committed in 8361f3704dd5e151ff1325e62ff5de658b6c62e6 and shipped in OpenClaw iOS 2026.8.11. Details are documented in GitHub Security Advisory GHSA-5j57-84cx-r295 and the VulnCheck advisory.

Workarounds

Disable the OpenClaw agent deep-link handler on managed devices until the update is deployed
Configure MDM policies to block user-initiated sysdiagnose collection and to expire any exported archives
Server-side, invalidate long-lived bearer keys and require short-lived, single-use tokens for agent submissions

bash

# Verify installed OpenClaw iOS version via MDM inventory query
mdmctl query --bundle-id com.openclaw.ios --attribute CFBundleShortVersionString

# Fail build if version is below the fixed release
required="2026.8.11"
installed=$(mdmctl query --bundle-id com.openclaw.ios --attribute CFBundleShortVersionString)
if [ "$(printf '%s\n' "$required" "$installed" | sort -V | head -n1)" != "$required" ]; then
  echo "OpenClaw iOS $installed is vulnerable to CVE-2026-95815 - upgrade to $required"
  exit 1
fi