OpenClaw iOS CVE-2026-95815

Exploitation requires LOCAL access to the device's iOS unified-log/diagnostic archives (e.g., a sysdiagnose bundle, backup, or MDM-collected logs) from an OpenClaw iOS build before 2026.8.11, where the agent deep-link handler logged the complete URL with the bearer key at privacy:.public. Additional limiting conditions: the recovered bearer key must still be unrotated (valid) at replay time, and the attacker must reconstruct a forged deep link - reflected in AV:L, AC:H, and AT:P. This is NOT remotely exploitable and is not triggerable against a default running app over the network; it depends on the attacker acquiring the log artifacts and on the key not having been rotated.

This is a genuine-but-conditional information-disclosure flaw (CWE-532), not a mass-exploitable network vulnerability. The vendor/CVE CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H) is internally consistent with the description: exploitation is LOCAL (attacker must obtain the device's diagnostic/unified-log archives), of HIGH complexity with additional attack requirements (AT:P - keys must still be unrotated and captured), and only passive user interaction. The 7.2 score is driven by the dual high impact (VC:H bearer-key recovery, VI:H forged deep-link agent submissions that bypass the local confirmation prompt), not by ease of access. No EPSS score, no CISA KEV listing, and no public POC were provided, so per precision rules this is 'no public exploit identified at time of analysis.' The vendor patch is confirmed (commit 8361f370 flips the URL log field from privacy:.public to dropping the URL entirely, plus a regression test). Net: real and worth patching on affected fleets, but the local-access + AC:H + AT:P gating makes it a moderate, targeted-risk issue rather than a widespread emergency. No signals conflict; the CVSS local vector aligns cleanly with the 'obtain diagnostic archives' description.

An attacker who gains access to an iOS diagnostic/sysdiagnose archive from a device running OpenClaw iOS before 2026.8.11 (e.g., a shared support bundle, backup, or MDM-collected log set) greps the unified logs for the 'agent deep link' entries, which record the full deep-link URL including the persistent bearer key. Because the key is unrotated, the attacker crafts a forged deep link with the recovered key and submits agent requests that skip the local confirmation prompt. No public POC is referenced, and exploitation requires local possession of the log archive plus a still-valid key (AC:H/AT:P).