CVE-2026-41398 | BDVDB-2026-329503 Detail

Description#

OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. Attackers can inject unauthorized agent.request runs by loading attacker-controlled pages from local-network or tailnet hosts, polluting session state and consuming budget.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-28Record published in the CVE List.
2. Version 22026-04-29Most recent update recorded in the CVE List.