Medium severity5.5NVD Advisory· Published Sep 26, 2026

CVE-2026-100581

Description

OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operator authority.

Affected products

OpenClaw/Openclawllm-fuzzy
Range: <2026.8.11

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/security/advisories/GHSA-gcm4-fmcp-2f9rnvd
www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-storage-via-share-extensionnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000