N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4p4f-fc8q-84m3

GHSA-4p4f-fc8q-84m3: OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

Summary

Before OpenClaw 2026.4.2, the iOS A2UI bridge treated generic local-network pages as trusted bridge origins. A page loaded from a local-network or tailnet host could trigger agent.request dispatch without the stricter trusted-canvas origin check.

Impact

A loaded attacker-controlled page could inject unauthorized non-owner agent.request runs into the active iOS node session, polluting session state and consuming budget. The demonstrated impact did not include owner-only actions or arbitrary host execution.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

49d08382a90f71dabe2877b3f6729ad85f808d57 — restrict A2UI action dispatch to trusted canvas URLs

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @nexrin for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4p4f-fc8q-84m3

GHSA-4p4f-fc8q-84m3:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.1	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability existed in the iOS A2UI bridge, which is responsible for communication between the web-based UI (canvas) and the native OpenClaw agent. The core issue was an overly permissive trust model for actions dispatched from the web view.

The function CanvasA2UIActionMessageHandler.userContentController in ScreenWebView.swift would process messages from the web view. To decide if a message was from a trusted source, it checked if the URL was a local file (the bundled scaffold) or if it was a local network URL by calling ScreenController.isLocalNetworkCanvasURL. This latter function simply checked if the URL's host was a local network address (e.g., localhost, 192.168.x.x).

This meant that any webpage loaded from a local network address was implicitly trusted to dispatch agent.request actions to the iOS node. An attacker could convince a user to open a malicious webpage hosted on the same local network (or the user's Tailnet). This page could then execute unauthorized actions, polluting the session state.

The patch rectifies this by removing the isLocalNetworkCanvasURL function entirely. It introduces a stricter trust model where a remote URL is only considered trusted if it has been explicitly marked as such during navigation. The ScreenController.navigate function was modified to accept a trustA2UIActions parameter, which is only set to true when navigating to the legitimate, capability-backed A2UI host. The isTrustedCanvasUIURL function was updated to enforce this new, explicit trust, effectively preventing generic local pages from dispatching actions.

Vulnerable functions

CanvasA2UIActionMessageHandler.userContentController

apps/ios/Sources/Screen/ScreenWebView.swift

This function is a message handler that receives actions from the WKWebView. The vulnerable version of this function used `isLocalNetworkCanvasURL` to trust any URL on the local network, allowing a malicious page on the local network to dispatch `agent.request` actions. The patch removes this check and relies solely on the stricter `isTrustedCanvasUIURL` function.

ScreenController.isLocalNetworkCanvasURL

apps/ios/Sources/Screen/ScreenController.swift

This function, which was entirely removed by the patch, is the root cause of the vulnerability. It incorrectly determined that any URL on the local network was trusted to dispatch A2UI actions. Its removal is a key part of the fix.

NodeAppModel.handleBridgeRequest

apps/ios/Sources/Model/NodeAppModel.swift

This function handles bridge commands, including 'navigate'. The vulnerable version allowed navigation to any URL without performing a trust check. This could be used to direct the webview to a malicious local webpage, which would then be trusted by `CanvasA2UIActionMessageHandler` to execute actions.

ScreenController.navigate

apps/ios/Sources/Screen/ScreenController.swift

The original `navigate` function did not have a mechanism to establish trust for the target URL. The patch adds the `trustA2UIActions` parameter to explicitly grant trust only when navigating to legitimate A2UI URLs, preventing generic local URLs from gaining action-dispatch authority.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.