CVE-2026-26321: OpenClaw Local File Disclosure via Feishu Extension
Summary
CVE-2026-26321: OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension. Affects openclaw versions < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source tool designed for media management and communication, particularly integrating with various platforms like Feishu. It allows users to send and receive media files seamlessly. However, a vulnerability in the Feishu extension has been identified, which could allow unauthorized access to local files on the server due to improper handling of user input.
Vulnerability Detail
The vulnerability arises from the Feishu extension's sendMediaFeishu function, which improperly treats attacker-controlled mediaUrl values as local filesystem paths. This flaw allows an attacker to read sensitive files from the server, such as /etc/passwd, if they can influence the input to this function. The potential ramifications include unauthorized access to sensitive data, leading to further exploitation of the system.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as possible.
Conclusion
In summary, CVE-2026-26321 is a significant vulnerability in the OpenClaw package that allows local file disclosure through the Feishu extension. Users are strongly advised to upgrade to version 2026.2.14 or newer to protect against potential exploitation.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows local file disclosure through the Feishu extension in OpenClaw, enabling attackers to read sensitive files.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The potential impacts include unauthorized access to sensitive files, which could lead to further exploitation and compromise of the system.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
While there are no specific workarounds, it is crucial to prioritize upgrading to the patched version as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
