CVE-2026-41398: OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

April 7, 2026 (updated April 28, 2026)

Before OpenClaw 2026.4.2, the iOS A2UI bridge treated generic local-network pages as trusted bridge origins. A page loaded from a local-network or tailnet host could trigger agent.request dispatch without the stricter trusted-canvas origin check.

References

github.com/advisories/GHSA-4p4f-fc8q-84m3
github.com/openclaw/openclaw/commit/49d08382a90f71dabe2877b3f6729ad85f808d57
github.com/openclaw/openclaw/security/advisories/GHSA-4p4f-fc8q-84m3
nvd.nist.gov/vuln/detail/CVE-2026-41398

Code Behaviors & Features

Detect and mitigate CVE-2026-41398 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →