EUVD-2026-43222
GHSA-cxgh-3ffg-vj6h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network access required (PR:L); SSRF enables server-initiated reads of internal resources (C:L) with no direct integrity or availability impact on the vulnerable system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashboard/routes/plugin.py of the component market_list Endpoint. Executing a manipulation of the argument custom_registry can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in AstrBot up to version 4.25.2 allows authenticated remote attackers to cause the server to issue arbitrary HTTP requests by supplying a malicious value for the custom_registry parameter at the market_list plugin marketplace endpoint. The affected function is get_online_plugins in astrbot/dashboard/routes/plugin.py. A public proof-of-concept exploit is available on GitHub, though this vulnerability is not listed in the CISA KEV catalog. The CVSS 4.0 score of 2.1 reflects the authentication barrier and constrained impact, making this a lower-priority but tactically exploitable issue for attackers with dashboard access.
Technical ContextAI
AstrBot is an AI chatbot and assistant framework developed by AstrBotDevs. The vulnerability resides in the plugin management subsystem: the get_online_plugins function in astrbot/dashboard/routes/plugin.py constructs server-side HTTP requests to fetch plugin registry data, using the caller-supplied custom_registry argument directly without sufficient validation or allowlisting. CWE-918 (Server-Side Request Forgery) describes this root cause: the application acts as a proxy on behalf of the attacker, issuing requests to attacker-controlled destinations from the server's network context. This enables probing of internal infrastructure, cloud metadata endpoints (e.g., 169.254.169.254), or other services unreachable from the public internet. The affected CPE is cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:* covering all versions through 4.25.2.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to the coordinated disclosure. As immediate compensating controls, administrators should restrict dashboard access to trusted, authenticated users only and avoid exposing the AstrBot dashboard to untrusted networks or the public internet, since PR:L exploitation requires dashboard credentials. Egress filtering should be applied at the network layer to block the AstrBot server process from making outbound HTTP/S requests to internal RFC-1918 address ranges, cloud metadata endpoints (169.254.169.254, fd00:ec2::254), and other sensitive internal services - note that overly broad egress blocking may break legitimate plugin marketplace functionality. Where possible, implement an allowlist of permitted registry URLs for the custom_registry parameter at the application or reverse proxy layer. Monitor for unusual outbound HTTP requests originating from the AstrBot process. Track the VulDB entry at https://vuldb.com/vuln/377807 and the upstream repository for any patch release.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today