A critical Server-Side Request Forgery vulnerability in the OpenClaw Feishu extension allows unauthenticated attackers to bypass security controls and reach internal services.

The software fails to properly sanitize inputs in the sendMediaFeishu function and markdown image processing, enabling unauthenticated attackers to trigger server-side requests to internal resources. This flaw is exacerbated by the ability to influence tool calls through prompt injection or direct manipulation.

Successful exploitation of this vulnerability permits unauthorized access to internal network resources that are otherwise shielded from the public internet. Given the CVSS score of 8.3, this represents a high-risk scenario where an attacker can scan internal infrastructure, access sensitive metadata services, or potentially exfiltrate data from internal systems, leading to significant security compromise.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later immediately via your package manager.

Proactive Monitoring: Review web server and application logs for suspicious outbound requests originating from the Feishu extension or unusual image processing activity.

Compensating Controls: Implement strict egress filtering on the host machine to restrict outbound traffic to known-good endpoints only, which effectively neuters the SSRF capability.

Public Exploit Available: Unknown.

The severity of this SSRF vulnerability necessitates immediate action to prevent internal network reconnaissance or service exploitation. Organizations currently utilizing the OpenClaw Feishu extension should prioritize the update to version 2026.2.14 to eliminate the flaw and protect internal assets from unauthorized access.