Technical impact
OpenClaw for iOS prior to version 2026.8.11 stores Gateway credentials in cleartext JSON within the App Group UserDefaults instead of the secure device Keychain. Because the credentials are not encrypted, an attacker who can access an unencrypted device backup or extract the App Group container can recover Gateway tokens and passwords, enabling authentication with operator authority. This exposes both the confidentiality of stored credentials and the integrity of operator sessions. The fault is a CWE-312 weakness, Cleartext Storage of Sensitive Information.
Affected Systems
All users of OpenClaw iOS version prior to 2026.8.11 are affected. The vulnerability applies to the OpenClaw application bundle on iOS devices.
Risk and Exploitability
The CVSS score of 6.8 indicates a moderate to high risk, while the EPSS score is unavailable, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers need access to an unencrypted backup or the device’s App Group container, which may be achieved by a local attacker who has physical or remote access to a compromised device or by extracting backups that are not encrypted. Once the credentials are retrieved, the attacker can impersonate a Gateway operator and gain unauthorized access to operator accounts.
