CVE-2026-28451: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28451 is a Server-Side Request Forgery (SSRF) vulnerability in the Feishu extension of OpenClaw, an npm-based AI agent framework. It affects all OpenClaw versions prior to 2026.2.14 and was publicly disclosed on March 5, 2026. The vulnerability exists in two code paths — the sendMediaFeishu function and markdown image URL processing — both of which fetch attacker-controlled remote URLs without SSRF protections. It carries a CVSS v3.1 base score of 9.3 (Critical) per Feedly intelligence, though the GitHub advisory rates it 8.6 (High) (GitHub Advisory, Feedly).

The root cause is CWE-918 (Server-Side Request Forgery), where the Feishu extension's sendMediaFeishu function and DocX markdown image processing pipeline passed user-supplied URLs directly to fetch() without any allowlist, blocklist, or IP-range validation. In the sendMediaFeishu path, a remote URL was fetched via a bare fetch(mediaUrl) call; in the markdown image path, downloadImage(url) similarly used an unguarded fetch(url). Attackers who can influence tool call parameters — either directly or via prompt injection into an AI agent workflow — can supply internal URLs (e.g., http://169.254.169.254/ for cloud metadata, or RFC-1918 addresses) and have the server fetch and re-upload the response as Feishu media, exfiltrating the content (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to make the OpenClaw server issue arbitrary HTTP requests to internal network resources, including cloud metadata services, internal APIs, and other services not exposed to the internet. The response content is re-uploaded as Feishu media, enabling exfiltration of sensitive data such as cloud credentials, internal service responses, and configuration secrets. The scope change (S:C in CVSS) reflects that the impact extends beyond the vulnerable component to internal infrastructure. Availability is not directly impacted, but confidentiality is rated High and integrity Low due to the potential for data exfiltration and limited manipulation of internal service interactions (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.035% (0.000350), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction, and can be triggered via prompt injection in AI agent workflows, lowering the practical barrier for exploitation in environments where OpenClaw processes untrusted input (Feedly, GitHub Advisory).

1. Reconnaissance: Identify OpenClaw deployments running versions prior to 2026.2.14 with the Feishu extension enabled, particularly instances that process external or user-supplied content through AI agent workflows.
2. Identify injection point: Determine whether the target allows direct tool call parameter manipulation or processes untrusted markdown/text content that could contain injected image URLs (e.g., via a chat interface, document input, or API endpoint).
3. Craft malicious URL: Prepare a target URL pointing to an internal resource, such as http://169.254.169.254/latest/meta-data/ (AWS metadata), http://10.0.0.1/admin, or another internal service endpoint.
4. Trigger via sendMediaFeishu or markdown image: Either (a) directly call the sendMediaFeishu tool with mediaUrl set to the internal URL, or (b) inject a markdown image tag such as ![x](http://169.254.169.254/latest/meta-data/iam/security-credentials/) into content processed by the feishu_doc write/append action.
5. Retrieve exfiltrated data: The server fetches the internal URL and re-uploads the response as Feishu media. The attacker retrieves the uploaded media from Feishu to read the internal service response, potentially obtaining cloud credentials or other sensitive data (GitHub Advisory, Patch Commit).

• Network: Outbound HTTP requests from the OpenClaw server process to RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1), or cloud metadata endpoints (169.254.169.254, fd00:ec2::254); unexpected connections to Feishu media upload APIs immediately following requests to internal addresses.
• Logs: Application logs showing sendMediaFeishu or feishu_doc tool invocations with mediaUrl or markdown image URLs pointing to internal IP ranges or metadata services; error messages referencing unexpected HTTP status codes from internal hosts.
• File System: Unexpected temporary files or buffers containing internal service responses in the OpenClaw working directory.
• Process: Node.js process (OpenClaw) initiating outbound connections to non-public IP addresses or cloud metadata endpoints, observable via network monitoring tools such as netstat, ss, or EDR telemetry.

Upgrade OpenClaw to version 2026.2.14 or later, which routes all Feishu remote media fetching through hardened runtime helpers (fetchRemoteMedia / loadWebMedia) that enforce SSRF policies, block private/internal IP resolution, and apply response size limits (Patch Commit, GitHub Advisory). As interim mitigations for environments that cannot immediately patch: apply network egress controls to prevent the OpenClaw server from reaching internal IP ranges and cloud metadata services; restrict or disable the Feishu extension if it is not required; and audit AI agent prompt inputs to detect and block prompt injection attempts that could supply malicious URLs.

The vulnerability was reported by researcher zpbrent and credited in the GitHub security advisory. The fix was contributed by @mbelinky and published by maintainer steipete. RedPacket Security flagged the CVE shortly after disclosure, and it was indexed by VulnCheck and ENISA's EUVD (EUVD-2026-9900). No significant broader media coverage or notable researcher commentary beyond the advisory and automated aggregators has been identified (GitHub Advisory, Feedly).