CVE-2026-100581CWE-312

CVE-2026-100581

Medium · published September 26, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operator authority.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00077 · 0.1th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-09-26T07:17Z
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-gcm4-fmcp-2f9r · [email protected]https://www.vulncheck.com/advisories/openclaw-ios-before-2026.8.11-credential-storage-via-share-extension · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 26 SEP 02:19Z
    OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension
    cvelistv5