CVE-2026-41398CWE-346

OpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridge

Low · published April 28, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. Attackers can inject unauthorized agent.request runs by loading attacker-controlled pages from local-network or tailnet hosts, polluting session state and consuming budget.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00199 · 9.2th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridge
    cvelistv5