OpenClaw SSRF Vulnerability: Prompt Injection Risks in AI Tooling

A recently disclosed vulnerability in OpenClaw's Feishu extension (CVE-2026-28451) demonstrates how prompt injection attacks can escalate into server-side request forgery (SSRF) through tool manipulation. This vulnerability highlights critical security gaps in AI agent tooling that can expose internal services to external attackers.

How the SSRF Attack Vector Works

The vulnerability leverages prompt injection techniques to manipulate AI agents into executing unauthorized tool calls. Attackers craft malicious prompts that trick the agent into using the Feishu extension to fetch remote URLs, effectively bypassing traditional SSRF protections. This occurs because the tool execution layer trusts the agent's decision-making without validating the underlying request context.

When an AI agent processes a poisoned prompt, it may generate tool calls that appear legitimate to the execution environment. The Feishu extension, designed to handle external API requests, becomes the conduit for accessing internal services that should remain protected from external access.

Real-World Implications for AI Deployments

This vulnerability affects any deployment where AI agents have access to web request tools. Internal APIs, cloud metadata services, and authentication endpoints become vulnerable to exposure. The attack demonstrates that traditional web application security boundaries don't automatically translate to AI agent ecosystems.

Production systems using similar tooling patterns face immediate risks. The combination of prompt injection vulnerability and privileged tool access creates a perfect storm where external attackers can pivot into internal networks through what appears to be legitimate agent activity.

Practical Defensive Measures

Implementing context-aware tool validation is crucial for preventing these attacks. The Model Context Protocol SDK provides mechanisms for accessing execution context that can help validate tool requests:

@mcp.tool()
def safe_external_request(ctx: Context[ServerSession, AppContext], url: str) -> str:
    """Validated external request tool with context awareness."""

    # Validate URL against allowed domains
    if not is_allowed_domain(url):
        raise ValueError("Request blocked: Domain not permitted")

    # Check request context for suspicious patterns
    if ctx.request_context.session_id in suspicious_sessions:
        raise ValueError("Request blocked: Suspicious session")

    # Execute only after validation
    return requests.get(url).text

Key defensive strategies include: - Implement strict domain allowlisting for all external tool requests - Add context validation in tool functions using MCP's type-safe context access - Monitor tool usage patterns for anomalous behavior - Segregate internal and external tool capabilities into separate security domains

Immediate Actions for Operators

1. Audit all AI agent tooling for SSRF vulnerability patterns
2. Implement request validation that considers both the target URL and the calling context
3. Review and restrict tool permissions based on the principle of least privilege
4. Monitor tool execution logs for suspicious URL access patterns

This vulnerability underscores that AI agent security requires rethinking traditional boundaries. Tool execution must incorporate both input validation and context awareness to prevent prompt injection from escalating into system compromise.

Reference: National Vulnerability Database CVE-2026-28451