EUVD-2026-43237
GHSA-hhgm-hv3h-m233
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring low-privilege auth (PR:L); scope changes as server reaches internal systems (S:C); confidentiality impact only, no direct integrity/availability effect on the vulnerable system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the file astrbot/dashboard/routes/tools.py of the component MCP Test Endpoint. The manipulation of the argument mcp_server_config.url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests via a manipulated mcp_server_config.url parameter. All AstrBot versions through 4.25.2 are affected via the ToolsRoute.test_mcp_connection function in astrbot/dashboard/routes/tools.py. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no vendor-issued patch at time of analysis.
Technical ContextAI
AstrBot is an AI bot/agent framework that implements the Model Context Protocol (MCP), a protocol for connecting language models to external tools and services. The vulnerable component is the MCP Test Endpoint in the web dashboard (astrbot/dashboard/routes/tools.py), which accepts a mcp_server_config.url parameter and uses it to initiate a connection test without sanitizing or restricting the target URL. CWE-918 (Server-Side Request Forgery) describes this root cause: user-controlled input is passed to a server-side HTTP request function without adequate validation of the destination, allowing an attacker to redirect server-originated requests to internal or unintended network destinations. The CPE string cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:* confirms the vulnerability spans all tracked versions up to 4.25.2.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the vendor did not respond to disclosure. As a primary compensating control, restrict access to the AstrBot dashboard to trusted, authenticated users only - avoid exposing the dashboard to the public internet or untrusted networks. Deploy network-level egress filtering on the host running AstrBot to block outbound requests to RFC-1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), and cloud metadata endpoints (169.254.169.254) - this prevents the most dangerous SSRF pivots without disabling the feature entirely, though it does not eliminate the vulnerability. If the MCP connection-testing feature is not operationally required, consider blocking or rate-limiting the endpoint /tools/test_mcp_connection at the reverse proxy layer. Monitor VulDB at https://vuldb.com/vuln/377808 and the AstrBotDevs GitHub repository for any forthcoming patch release.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today