OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. (CVE-2026-100581)
OpenClaw for iOS versions before 2026.8.11 improperly store Gateway credentials as cleartext JSON in App Group UserDefaults instead of using the device Keychain. This insecure storage allows attackers with access to unencrypted device backups or extracted App Group containers to retrieve valid Gateway tokens and passwords, potentially enabling unauthorized authentication with operator privileges.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2026-100581 affects OpenClaw for iOS versions prior to 2026.8.11. The application stores Gateway credentials in cleartext JSON format within App Group UserDefaults rather than securely in the device Keychain. This storage method exposes sensitive authentication tokens and passwords to attackers who can access unencrypted device backups or extract App Group containers, compromising operator-level authentication.
Potential Impact
Attackers with local access to unencrypted device backups or the ability to extract App Group containers can recover valid Gateway tokens and passwords. This exposure allows them to authenticate with operator authority, potentially leading to unauthorized access to sensitive systems or functions. The CVSS score of 5.5 (medium severity) reflects the requirement for local access and low complexity for exploitation but significant confidentiality impact.
Mitigation Recommendations
A fix is available in OpenClaw for iOS version 2026.8.11 and later, which stores Gateway credentials securely in the device Keychain. Users and administrators should update to version 2026.8.11 or newer to remediate this vulnerability. Until the update is applied, avoid creating unencrypted device backups and restrict access to App Group containers to trusted parties only.
OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. (CVE-2026-100581)
Description
OpenClaw for iOS versions before 2026.8.11 improperly store Gateway credentials as cleartext JSON in App Group UserDefaults instead of using the device Keychain. This insecure storage allows attackers with access to unencrypted device backups or extracted App Group containers to retrieve valid Gateway tokens and passwords, potentially enabling unauthorized authentication with operator privileges.
CVSS v3.1
Score 5.5medium
Affected software
pkg:github/openclaw/openclawRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-100581 affects OpenClaw for iOS versions prior to 2026.8.11. The application stores Gateway credentials in cleartext JSON format within App Group UserDefaults rather than securely in the device Keychain. This storage method exposes sensitive authentication tokens and passwords to attackers who can access unencrypted device backups or extract App Group containers, compromising operator-level authentication.
Potential Impact
Attackers with local access to unencrypted device backups or the ability to extract App Group containers can recover valid Gateway tokens and passwords. This exposure allows them to authenticate with operator authority, potentially leading to unauthorized access to sensitive systems or functions. The CVSS score of 5.5 (medium severity) reflects the requirement for local access and low complexity for exploitation but significant confidentiality impact.
Mitigation Recommendations
A fix is available in OpenClaw for iOS version 2026.8.11 and later, which stores Gateway credentials securely in the device Keychain. Users and administrators should update to version 2026.8.11 or newer to remediate this vulnerability. Until the update is applied, avoid creating unencrypted device backups and restrict access to App Group containers to trusted parties only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rf6v-wq4h-m8xh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100581"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ab74f26f7a7c54106e12ed4
Added to database: 09/26/2026, 04:50:46 UTC
Last enriched: 09/26/2026, 04:53:02 UTC
Last updated: 09/26/2026, 09:45:54 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.