The vulnerability exists in the Feishu extension of OpenClaw and allows attackers to direct the server to fetch arbitrary remote URLs via the sendMediaFeishu function or markdown image handling. By doing so, an attacker can retrieve content from internal services, upload that content back as Feishu media, or manipulate tool calls or prompts to trigger further requests. The result is potential exposure of internal network resources and data, and the ability to perform unauthorized actions as the application server.

OpenClaw products, specifically any installation running a version before 2026.2.14. The affected code resides in the Feishu extension media fetching functionality and in markdown image processing. Users of the OpenClaw application that rely on the Feishu integration are exposed to this flaw.

The CVSS score of 6.3 indicates a severity. The EPSS score of less than 1% suggests the probability of exploitation is very low at present. This vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is an authenticated or low‑privilege user submitting a Feishu media request or markdown content that triggers the server to perform the malicious request. Successful exploitation requires that the attacker can send the relevant data to the application, after which the server will reach out to the target URL internally or externally, fetch the response, and optionally upload it back as media.