PT-2026-57561 · Astrbotdevs · Astrbot

Eric-A · Published 2026-07-12 · Updated 2026-07-12 · CVE-2026-15501

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AstrBotDevs AstrBot versions prior to 4.25.3

Description An issue exists in the MCP Test Endpoint component within the ToolsRoute.test mcp connection() function located in the astrbot/dashboard/routes/tools.py file. A remote attacker can manipulate the mcp server config.url argument to perform server-side request forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources.

Recommendations Update AstrBotDevs AstrBot to version 4.25.3 or later. As a temporary mitigation, restrict access to the ToolsRoute.test mcp connection() function.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-15501

Affected Products

Astrbot

References · 8

• 🔥 https://gist.github.com/YLChen-007/b68732c140fb11d844b214cf2db50a5a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-15501 · Security Note
• https://vuldb.com/vuln/377808 · Note
• https://vuldb.com/cve/CVE-2026-15501 · Note
• https://vuldb.com/vuln/377808/cti · Note
• https://vuldb.com/submit/844665 · Note
• https://twitter.com/CVEnew/status/2076339902929657945 · Twitter Post
• https://twitter.com/infoflowcloud/status/2076340995235500291 · Twitter Post