CVE-2026-28451 is a server-side request forgery flaw in the OpenClaw Feishu extension. Media fetching could reach attacker-controlled or internal URLs without SSRF protections, including through prompt injection. NVD scores it 8.3. Upgrade openclaw to 2026.2.14 or later, and restrict outbound network access from the host.
What's affected
The GitHub advisory GHSA-x22m-j5qq-j49m lists affected versions before 2026.2.14 and patched versions 2026.2.14 and later of the npm package openclaw.
The advisory names two paths in the Feishu extension that fetched remote URLs without SSRF protections: the media sending function, and image URLs in Feishu document markdown during write and append. The attacker needs to influence tool calls, directly or through prompt injection.
The advisory rates it High at 8.6, and the NVD record shows 8.3. The weakness is CWE-918 (Server-Side Request Forgery).
How to check if you're exposed
Check the OpenClaw version in each project and global install.
npm ls openclaw
npm ls -g openclaw
Then check whether the Feishu extension is installed and enabled, and what network the OpenClaw host can reach. The more internal services it can see, the more an SSRF can expose.
What to do now
- Upgrade openclaw to 2026.2.14 or later.
- Restrict outbound network access from the OpenClaw host to what it needs, and block access to internal metadata and management addresses.
- Limit who can influence tool calls, and treat content that the agent reads as untrusted.
- Review which internal services are reachable from the host and whether they require authentication.
- Review egress logs for requests to internal addresses from the OpenClaw process.
Why it matters
Server-side request forgery turns a server into a proxy for the attacker. The server fetches a URL it was given, from inside the network, where it may be able to reach services the attacker cannot. The response can then be returned or stored somewhere the attacker can see it.
In this record the fetched response is re-uploaded as Feishu media, which is the route out. The advisory's fix sends all remote media fetching through hardened helpers that enforce SSRF policies and size limits, which is the right shape: one well-tested function for outbound fetches, not many ad hoc ones.
Agents add a twist. The URL may come from content the model read, so a prompt injection in a web page or message can become an SSRF. Defences belong in the tool code, because the model cannot be trusted to refuse.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
How can prompt injection lead to SSRF?
If the agent can choose URLs for a tool to fetch, text it reads can steer that choice. The advisory says attackers may influence tool calls directly or through prompt injection.
What did the fix change?
Feishu remote media fetching now goes through hardened runtime helpers that enforce SSRF policies and size limits.
Sources
Last reviewed: 19 October 2026.
