Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100551OpenClaw iOS Control UI TLS Pin Enforcement Bypass
High 8.3
In plain English
A high-severity improper certificate validation in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an attacker able to redirect the same host and port and present a different certificate that is accepted by iOS system trust can serve a replacement Control UI page; opening the Terminal or a session Dashboard then allows that page to read the injected Gateway token or password. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. This issue is fixed in 2026.8.11.
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-jjpc-p3xf-8g7p) vendor-advisory
- VulnCheck Advisory: OpenClaw iOS Control UI TLS Pin Enforcement Bypass third-party-advisory