CVE-2026-28451 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.14 contains a server-side request forgery caused by insufficient SSRF protections in the Feishu extension's sendMediaFeishu function and markdown image processing, letting attackers fetch attacker-controlled URLs and re-upload responses as media, exploit requires attacker to manipulate tool calls or prompt injection.

Severity & Score

Impact

Attackers can make unauthorized requests to internal services and re-upload responses, potentially leading to data exposure or further attacks.

Mitigation

Update to version 2026.2.14 or later.

References

• https://github.com/openclaw/openclaw/commit/5b4121d6011a48c71e747e3c18197f180b872c5d
• https://github.com/openclaw/openclaw/security/advisories/GHSA-x22m-j5qq-j49m
• https://www.vulncheck.com/advisories/openclaw-ssrf-via-feishu-extension-media-fetching

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner