iFlytek astron-agent EUVD-2026-85001

Requires an authenticated user (PR:L) with access to the astron-agent console debugToolV2 API endpoint that invokes UrlCheckTool.checkUrl, and the ability to supply the endPoint argument. Exploitation depends on the pre-patch redirect handling: the validator followed only one redirect hop and did not account for 307/308 responses, so the attacker must control (or point at) a URL that survives the initial blacklist/whitelist check and then redirects the server-side request to an internal target. It is limited to astron-agent versions up to 1.0.6; upgrading to reward-1575 (bounded 5-hop chain with per-hop revalidation and loop detection) closes it. No user interaction by a victim is needed, but the attacker must hold valid console credentials.

This is a genuine but low-priority SSRF. The vendor CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a network-reachable flaw that nonetheless requires authentication (PR:L) - the debugToolV2 API endpoint is a console/toolkit developer feature, not an anonymous surface - and yields only low technical impact across confidentiality, integrity and availability. There is no EPSS score, no CISA KEV listing, and no vendor/CISA confirmation of active exploitation, so exploitation status is 'no public exploit identified at time of analysis' (a public GitHub disclosure issue #1323 and the VulDB CTI record exist, but those are advisory artifacts, not weaponized exploit code). The source-code evidence clarifies the true nature: the SSRF is a redirect-based blacklist bypass - the pre-patch UrlCheckTool followed only a single 301/302/303 redirect and validated only that one hop, so an attacker-controlled endpoint returning a redirect chain (or 307/308, which weren't handled) could steer the server-side request to an internal address after the guard had passed. The fix bounds the chain (MAX_REDIRECTS=5), handles 307/308, and re-validates every hop with loop detection. Net: real bug, plausibly exploitable by an authenticated console user, but low impact and niche footprint make it a routine-patch item, not an emergency.

An authenticated user of the astron-agent console supplies a crafted endPoint to the debugToolV2 UrlCheckTool.checkUrl API pointing at an attacker-controlled host that passes the blacklist and then issues an HTTP redirect (or a 307/308 the old code ignored) to an internal service such as a cloud metadata endpoint or an internal admin API. Because the pre-patch code only validated a single redirect hop, the server follows the redirect to the internal target, producing server-side request forgery. No public weaponized exploit is identified, though the flaw was publicly disclosed via GitHub issue #1323.