CVE-2026-95815
Last modified
CVE-2026-95815 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| OpenClaw | OpenClaw iOS | < 2026.8.11 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-95815?
How severe is CVE-2026-95815?
How do I fix CVE-2026-95815?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-95805A typo in the MISP ACLComponent access control configuration…5.3
- CVE-2026-95806MISP ships with PHP's phar stream wrapper registered in both…7.7
- CVE-2026-9581A vulnerability was identified in JeecgBoot up to 3.9.1. The…6.3
- CVE-2026-95812ClipBucket v5 before 5.5.3-#182 contains a reflected cross-s…6.1
- CVE-2026-95813e621ng versions before 26.09.16 pass untrusted request param…6.1
- CVE-2026-95814Vaultwarden through 1.37.3 omits organization membership sta…8.1
- CVE-2026-95818A stack-based buffer overflow in the dynamic loader (ld.so) …3.6
- CVE-2026-95819A vulnerability has been found in anirbandutta9 College-Note…7.3
- CVE-2026-9582A security flaw has been discovered in SourceCodester CET Au…4.3
- CVE-2026-95820A vulnerability was found in anirbandutta9 College-Notes-Gal…6.3
- CVE-2026-95828A vulnerability was determined in Mstfakts College-Managemen…4.3
- CVE-2026-95829A vulnerability was identified in TDuckCloud tduck-platform …6.3
Are you affected by CVE-2026-95815?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST