Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. Attackers can inject unauthorized agent.request runs by loading attacker-controlled pages from local-network or tailnet hosts, polluting session state and consuming budget.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41398 Improper Access Control in OpenClaw iOS A2UI Bridge Before 2026.4.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41398
Post summary
The passage announces a new vulnerability (CVE‑2026‑41398) in OpenClaw iOS A2UI Bridge involving improper access control before version 2026.4.2, but contains no evidence of exploitation or patch information.
CVE-2026-41398 OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. Attacker… https://www.cve.org/CVERecord?id=CVE-2026-41398
Post summary
The text announces CVE‑2026‑41398, describing an improper access control issue in OpenClaw’s iOS A2UI bridge that accepts generic local‑network pages as trusted origins.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |