What is the CVSS score of CVE-2026-28451?

CVE-2026-28451 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-28451?

OpenClaw versions before 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that could allow attackers to access internal systems and sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-28451?

Within 24 hours: Identify all systems running OpenClaw versions prior to 2026.2.14 and assess Feishu extension usage. Within 7 days: Apply the available patch to all affected systems or disable the Feishu extension if patching cannot be completed. Within 30 days: Conduct security testing to verify the patch resolves the vulnerability and review logs for any suspicious activity related to sendMediaFeishu or markdown image processing functions.

AI / ML CVE-2026-28451

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-05 disclosure@vulncheck.com

GHSA-x22m-j5qq-j49m

SSRF AI / ML Openclaw

8.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 11, 2026 - 16:15 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 8.3

DescriptionNVD

OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs without SSRF protections via sendMediaFeishu function and markdown image processing. Attackers can influence tool calls through direct manipulation or prompt injection to trigger requests to internal services and re-upload responses as Feishu media.

AnalysisAI

OpenClaw versions before 2026.2.14 contain unprotected server-side request forgery flaws in the Feishu extension that enable remote attackers to access internal services and exfiltrate data without authentication. Attackers can exploit the sendMediaFeishu function and markdown image processing through direct manipulation or prompt injection to force the application to fetch attacker-controlled URLs and re-upload responses as Feishu media. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious prompt injection

Exploit

Trigger sendMediaFeishu function

Execution

Fetch internal service URLs

Impact

Re-upload responses as Feishu media