CVE-2026-41398: OpenClaw Auth Bypass Vulnerability

CVE-2026-41398 Overview

OpenClaw before version 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. Attackers can inject unauthorized agent.request runs by loading attacker-controlled pages from local-network or tailnet hosts, polluting session state and consuming budget.

Critical Impact

Improper origin validation allows attackers on adjacent networks to abuse trusted origin assumptions, leading to unauthorized agent request dispatching, session state pollution, and resource budget consumption.

Affected Products

• OpenClaw versions prior to 2026.4.2
• OpenClaw iOS A2UI bridge component

Discovery Timeline

• 2026-04-28 - CVE CVE-2026-41398 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41398

Vulnerability Analysis

This vulnerability stems from improper access control in the iOS A2UI bridge component of OpenClaw. The bridge fails to properly validate origin sources, treating any page originating from the local network as a trusted origin. This trust assumption is flawed because attackers with access to the same network segment can host malicious pages that are incorrectly granted trusted status.

The vulnerability is classified under CWE-346 (Origin Validation Error), which describes scenarios where software does not properly verify the source of a message or communication. In this case, the iOS A2UI bridge lacks sufficient origin validation mechanisms to differentiate between legitimate trusted local pages and attacker-controlled content hosted on the same network.

Root Cause

The root cause is improper origin validation in the iOS A2UI bridge. The bridge implementation assumes all local-network or tailnet-hosted pages are inherently trustworthy without implementing proper authentication or authorization checks. This design flaw allows any entity on the adjacent network to bypass intended access controls.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same local network or tailnet as the victim. The attacker hosts a malicious page on a local-network host, which the vulnerable OpenClaw iOS A2UI bridge incorrectly treats as a trusted origin. When a user with the vulnerable application loads this attacker-controlled page, the application permits unauthorized agent.request dispatches.

The attack chain involves:

1. Attacker gains access to the same local network as the target
2. Attacker hosts a malicious web page on a local-network or tailnet host
3. Victim's OpenClaw iOS application loads the attacker-controlled page
4. The A2UI bridge incorrectly trusts the page's origin
5. Attacker injects unauthorized agent.request calls, polluting session state and consuming budget

For technical exploitation details, refer to the GitHub Security Advisory GHSA-4p4f-fc8q-84m3 and the VulnCheck Advisory.

Detection Methods for CVE-2026-41398

Indicators of Compromise

• Unexpected agent.request calls originating from unrecognized local-network sources
• Abnormal session state modifications or corruption without user-initiated actions
• Unusual budget consumption patterns in OpenClaw agent activities
• Network traffic from local hosts attempting to interact with the A2UI bridge

Detection Strategies

• Monitor iOS application logs for agent.request calls from non-standard or unexpected origins
• Implement network monitoring to detect suspicious local-network page requests targeting the A2UI bridge
• Review session state changes for unauthorized modifications not correlating with user activity
• Deploy endpoint detection solutions to identify anomalous inter-process communication patterns

Monitoring Recommendations

• Enable verbose logging for the OpenClaw iOS A2UI bridge component to capture origin information
• Configure alerts for budget consumption exceeding expected thresholds
• Monitor for unusual local-network traffic patterns that may indicate exploitation attempts
• Review application behavior on shared or untrusted network environments

How to Mitigate CVE-2026-41398

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.2 or later immediately
• Avoid using OpenClaw on untrusted or shared local networks until patched
• Review session state and budget usage for signs of prior exploitation
• Restrict network access to trusted devices where possible

Patch Information

OpenClaw has released version 2026.4.2 which addresses this vulnerability. The fix implements proper origin validation for the iOS A2UI bridge, ensuring only legitimately trusted origins can dispatch agent.request calls. The patch can be reviewed in the GitHub Commit Update.

Workarounds

• Use OpenClaw only on trusted, isolated networks where attackers cannot host malicious pages
• Implement network segmentation to limit exposure to potentially malicious local-network hosts
• Monitor and restrict which local-network resources the OpenClaw iOS application can access
• Consider disabling the A2UI bridge functionality if not required until the patch is applied

For environments where immediate patching is not feasible, network-level controls and application monitoring provide interim protection while upgrade planning proceeds.