CVE-2026-28451

High

Description

OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs without SSRF protections via sendMediaFeishu function and markdown image processing. Attackers can influence tool calls through direct manipulation or prompt injection to trigger requests to internal services and re-upload responses as Feishu media.

SeverityHigh

CVSS8.3

Exploit probability—

ProductOpenclaw

PublishedMar 5, 2026

First seenMar 5, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

openclaw openclaw2026.2.14 or later
openclaw2026.2.14 or later

Patches

github.com/openclaw/openclaw/commit/5b4121d6011a48c71e747e3c18197f180b872c5d

Vendor advisories

github.com/openclaw/openclaw/security/advisories/GHSA-x22m-j5qq-j49m

Affected products

Product	Affected versions	Fixed in
openclaw openclaw	v < 2026.2.14	2026.2.14
openclawnpm	v < 2026.2.14	2026.2.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.