OpenClaw iOS App Stores Gateway Credentials in Cleartext

Executive Summary

OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. This means sensitive tokens and passwords are saved in an unencrypted format outside the secure Keychain storage. Attackers with access to unencrypted device backups or extracted App Group containers can recover these credentials to gain operator-level access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the App Group UserDefaults storage on iOS devices running OpenClaw versions prior to 2026.8.11. Check for cleartext JSON files containing Gateway credentials. Use forensic tools to extract App Group containers from backups or jailbroken devices and search for sensitive data in plaintext.

Useful 0 Not Useful 0

Impact Analysis

If you use OpenClaw iOS versions before 2026.8.11, an attacker could recover your Gateway credentials from unencrypted backups or device images. This could allow them to authenticate with operator authority, potentially accessing sensitive systems or data. The risk is higher if you use unencrypted backups or if your device is compromised.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for protecting sensitive data, such as GDPR and HIPAA, due to cleartext storage of credentials. GDPR mandates strong protection for personal data, while HIPAA requires safeguarding protected health information. Storing credentials insecurely could lead to unauthorized access and data breaches, resulting in legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenClaw for iOS to version 2026.8.11 or later. Avoid creating unencrypted device backups. If backups or device images may have been exposed, rotate Gateway credentials immediately to prevent unauthorized access.

Useful 0 Not Useful 0