The vulnerability in OpenClaw’s iOS A2UI bridge allows agents to execute unauthorized requests. By treating generic local‑network pages as trusted origins, the system accepts agent.request calls from attacker‑controlled sources. This can corrupt session state and deplete allotted resources, but does not provide arbitrary code execution or direct access to protected data. The weakness is identified as CWE‑346, improper access control.

Versions of OpenClaw prior to 2026.4.2 are affected. The issue resides in the iOS A2UI bridge component, which processes web page origins without adequate validation. Users running any configuration that loads local‑network or tailnet hosts through the bridge are at risk.

The CVSS score of 2.1 indicates a low severity assessment. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is unlikely at present. The attack likely requires the attacker to serve a malicious page over the local network or tailnet that the device accesses via the A2UI bridge; no remote network access is needed. While the exploit can disrupt a session and waste budget, it does not compromise confidentiality or integrity beyond the affected application context.