Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

OpenClaw iOS Control UI may expose gateway credentials

CVE-2026-100551 · published 18 days ago
Summary

Versions of OpenClaw for iOS released between July 2026 and August 2026 do not check the saved security certificate when showing the Control UI, allowing a fake page to be shown if an attacker can redirect the connection. That fake page can capture the gateway password or token, giving the attacker full operator access to the system. Update to the version released after August 2026 to restore proper certificate checking.

What to do
  • Update openclaw openclaw to version 2026.8.11 or later.
Affected software
VendorProductAffected versions
openclaw openclaw < 2026.8.11
Original advisory text
OpenClaw iOS Control UI TLS Pin Enforcement Bypass
OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an attacker able to redirect the same host and port and present a different certificate that is accepted by iOS system trust can serve a replacement Control UI page; opening the Terminal or a session Dashboard then allows that page to read the injected Gateway token or password. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. This issue is fixed in 2026.8.11.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published26 Sep 2026
Updated14 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100551 · NVD
CVE-2026-100551 · MITRE
Track software like this
Free during beta