En bref
- CVE-2026-28451 est une vulnérabilité CRITIQUE (CVSS 9.3) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.32%, plus élevée que 24.9% des vulnérabilités.
- Correctif : mettre à jour vers 2026.2.14 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.2.14
| 2026.2.14
|
| openclaw npm | < 2026.2.14
| 2026.2.14
|
Description
Summary
The Feishu extension could fetch attacker-controlled remote URLs in two paths without SSRF protections:
sendMediaFeishu(mediaUrl)- Feishu DocX markdown image URLs (write/append -> image processing)
Affected versions
Patched versions
Impact
If an attacker can influence tool calls (directly or via prompt injection), they may be able to trigger requests to internal services and re-upload the response as Feishu media.
Remediation
Upgrade to OpenClaw 2026.2.14 or newer.
Notes
The fix routes Feishu remote media fetching through hardened runtime helpers that enforce SSRF policies and size limits.
NVD description
OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs without SSRF protections via sendMediaFeishu function and markdown image processing. Attackers can influence tool calls through direct manipulation or prompt injection to trigger requests to internal services and re-upload responses as Feishu media.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free