Openclaw cli: OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch (CVE-2026-41398)

Before OpenClaw 2026.4.2, the iOS A2UI bridge incorrectly trusted generic local-network pages as valid bridge origins, allowing pages from local-network or tailnet hosts to trigger agent.request dispatch without the stricter trusted-canvas origin verification. This flaw permits an attacker-controlled page to inject unauthorized non-owner agent.request operations into an active iOS node session, leading to session state pollution and budget consumption. The vulnerability does not allow owner-only actions or arbitrary code execution on the host. The vulnerability affects openclaw npm package versions from 2026.1.29 up to but not including 2026.4.2. The issue is fixed by restricting A2UI action dispatch to trusted canvas URLs in commit 49d08382a90f71dabe2877b3f6729ad85f808d57.

An attacker controlling a page loaded from a local-network or tailnet host can inject unauthorized non-owner agent.request commands into an active iOS node session. This can corrupt session state and consume operational budget. However, the vulnerability does not permit execution of owner-only actions or arbitrary code on the host system.

A patch is available in OpenClaw version 2026.4.2 that restricts A2UI action dispatch to trusted canvas URLs, eliminating the vulnerability. Users should upgrade to version 2026.4.2 or later once it is published. Until then, caution is advised when loading pages from local-network or tailnet hosts in affected versions.