CVE-2026-28451: OpenClaw SSRF Vulnerability

CVE-2026-28451 Overview

CVE-2026-28451 is a Server-Side Request Forgery (SSRF) vulnerability affecting OpenClaw versions prior to 2026.2.14. The vulnerability exists in the Feishu extension, specifically in the sendMediaFeishu function and markdown image processing components. Attackers can exploit this flaw to fetch attacker-controlled remote URLs without SSRF protections, potentially accessing internal services and re-uploading responses as Feishu media.

The vulnerability can be triggered through direct manipulation of tool calls or via prompt injection techniques, making it particularly concerning in environments where OpenClaw processes untrusted input.

Critical Impact

Attackers can leverage this SSRF vulnerability to probe internal network services, exfiltrate sensitive data from protected resources, and potentially pivot to other systems within the infrastructure.

Affected Products

• OpenClaw versions prior to 2026.2.14
• OpenClaw Feishu extension component

Discovery Timeline

• 2026-03-05 - CVE-2026-28451 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28451

Vulnerability Analysis

This SSRF vulnerability (CWE-918: Server-Side Request Forgery) allows attackers to manipulate OpenClaw into making HTTP requests to arbitrary URLs. The Feishu extension lacks proper URL validation and SSRF protections in two critical areas: the sendMediaFeishu function and the markdown image processing pipeline.

When processing requests, the vulnerable components fetch remote resources without validating that the target URLs are safe or external. This allows attackers to craft malicious requests targeting internal network resources that would otherwise be inaccessible from outside the network perimeter.

The attack surface is expanded by the ability to influence tool calls through prompt injection, a technique where malicious instructions embedded in user-controlled content manipulate the application's behavior.

Root Cause

The root cause of CVE-2026-28451 is insufficient input validation and missing SSRF protections in the Feishu extension's media handling functionality. The sendMediaFeishu function and markdown image processor accept user-controlled URLs without:

• Validating that URLs resolve to external, non-sensitive addresses
• Blocking requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Implementing allowlists for permitted domains
• Restricting protocols to safe options (e.g., HTTP/HTTPS only)

Attack Vector

An attacker can exploit this vulnerability through the network by providing malicious URLs that target internal services. The attack can be initiated either by directly manipulating tool call parameters or by crafting prompt injection payloads that cause OpenClaw to make requests to attacker-specified endpoints.

The exploitation flow involves submitting a crafted request containing an internal URL (such as http://169.254.169.254/ for cloud metadata services or internal API endpoints). OpenClaw's Feishu extension processes this URL, fetches the content, and re-uploads it as Feishu media, effectively exfiltrating internal data to an attacker-accessible location.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory and the VulnCheck Advisory.

Detection Methods for CVE-2026-28451

Indicators of Compromise

• Outbound HTTP requests from OpenClaw to internal IP ranges (RFC 1918 addresses)
• Requests to cloud metadata endpoints such as 169.254.169.254
• Unusual Feishu media uploads containing sensitive internal data
• Error logs indicating failed connections to internal services

Detection Strategies

• Monitor network traffic for outbound requests from OpenClaw servers to internal IP ranges or localhost
• Implement web application firewall (WAF) rules to detect SSRF patterns in incoming requests
• Review Feishu extension logs for suspicious URL patterns or unexpected media uploads
• Deploy intrusion detection signatures for common SSRF probe patterns

Monitoring Recommendations

• Enable verbose logging for the Feishu extension to capture all URL fetch operations
• Set up alerts for any outbound connections from OpenClaw to non-whitelisted internal addresses
• Monitor for prompt injection indicators in user inputs processed by OpenClaw
• Implement egress filtering to detect and block unauthorized internal network access attempts

How to Mitigate CVE-2026-28451

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.14 or later immediately
• Review network segmentation to limit OpenClaw's access to internal resources
• Implement egress filtering to restrict outbound connections from OpenClaw servers
• Audit recent Feishu media uploads for potential data exfiltration

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.2.14. The fix is available in commit 5b4121d6011a48c71e747e3c18197f180b872c5d. Organizations should update to this version or later to remediate CVE-2026-28451.

Additional details about the security fix can be found in the GitHub Security Advisory.

Workarounds

• Disable the Feishu extension if not required until patching is complete
• Implement network-level SSRF protections using a proxy or firewall that blocks requests to internal IP ranges
• Deploy a reverse proxy in front of OpenClaw with URL validation rules
• Restrict OpenClaw's network access using security groups or firewall rules to prevent access to sensitive internal services

# Example: Block outbound requests to internal IP ranges using iptables
# Apply to the server running OpenClaw

# Block RFC 1918 private addresses
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner openclaw -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner openclaw -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner openclaw -j DROP

# Block link-local and metadata endpoints
iptables -A OUTPUT -d 169.254.0.0/16 -m owner --uid-owner openclaw -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner openclaw -j DROP