CVE-2026-100581
Last modified
CVE-2026-100581 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operator authority..
Description
OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operator authority.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| OpenClaw | OpenClaw | < 2026.8.11 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-100581?
How severe is CVE-2026-100581?
How do I fix CVE-2026-100581?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-100576OpenClaw versions before 2026.8.1 contain a server-side requ…5.4
- CVE-2026-100577OpenClaw versions before 2026.8.1 fail to validate video ass…6.3
- CVE-2026-100578OpenClaw (npm package `openclaw`) before 2026.7.1 fails to r…7.6
- CVE-2026-100579OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectl…7.6
- CVE-2026-10058ITS Intelligent SCADA System developed by ITP Technology has…4.8
- CVE-2026-100580OpenClaw (npm package 'openclaw') before 2026.7.1 improperly…8.8
- CVE-2026-100582OpenClaw channel plugins (@openclaw/msteams, @openclaw/feish…6.5
- CVE-2026-100583OpenClaw Discord versions before 2026.7.1 contain an authori…4.3
- CVE-2026-100584OpenClaw is an npm-distributed agent runtime. In versions >=…6.7
- CVE-2026-100585OpenClaw (npm package `openclaw`) before 2026.7.1 fails to e…8
- CVE-2026-100586OpenClaw Codex before 2026.7.1 fails to properly enforce own…8.8
- CVE-2026-100587OpenClaw versions before 2026.7.1 fail to properly validate …8.8
Are you affected by CVE-2026-100581?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST