Openclaw cli: OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension (CVE-2026-28451)

OpenClaw CLI prior to version 2026.2.14 has two SSRF vulnerabilities in its Feishu extension: one in the sendMediaFeishu(mediaUrl) function and another in the handling of Feishu DocX markdown image URLs during write or append operations. Both paths lack SSRF protections, enabling attacker-controlled URL fetching. Exploitation requires the attacker to influence tool calls directly or via prompt injection. The vulnerabilities allow requests to internal services and re-uploading of responses as Feishu media. The vulnerabilities are patched in OpenClaw CLI version 2026.2.14 by introducing hardened runtime helpers that enforce SSRF protections and size limits.

Successful exploitation could allow an attacker to make the OpenClaw CLI fetch arbitrary internal or external URLs without SSRF protections, potentially accessing internal services. The attacker could then re-upload the fetched content as Feishu media. The CVSS score is 8.6 (High), indicating a high-severity impact with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact.

Upgrade OpenClaw CLI to version 2026.2.14 or later. This version includes hardened runtime helpers that enforce SSRF policies and size limits, effectively mitigating the vulnerabilities.