CVE-2026-15501 in AstrBot
Summary
by MITRE • 07/12/2026
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the file astrbot/dashboard/routes/tools.py of the component MCP Test Endpoint. The manipulation of the argument mcp_server_config.url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the AstrBotDevs AstrBot platform version 4.25.2 and earlier, specifically targeting the ToolsRoute.test_mcp_connection function located in astrbot/dashboard/routes/tools.py. The issue stems from insufficient input validation and sanitization of the mcp_server_config.url parameter, creating a critical server-side request forgery vulnerability that can be exploited remotely. The flaw allows attackers to manipulate the URL argument to redirect requests to arbitrary destinations, potentially enabling unauthorized access to internal systems or services that the vulnerable application can reach.
The technical implementation of this vulnerability follows CWE-918, which classifies server-side request forgery as a critical security weakness where applications fail to properly validate and sanitize user-supplied URLs before using them in HTTP requests. The attack vector operates through remote exploitation since the vulnerable function is exposed via an API endpoint that accepts external input. An attacker can craft malicious payloads that modify the mcp_server_config.url parameter to point to internal services or external malicious endpoints, potentially leading to data exfiltration, internal network reconnaissance, or further compromise of systems within the network perimeter.
The operational impact of this vulnerability extends beyond simple data theft, as it can enable attackers to perform lateral movement within networks where AstrBot is deployed. The vulnerability's public disclosure status increases risk exposure significantly since threat actors can readily implement known exploitation techniques without requiring additional research or development time. Organizations running affected versions may experience unauthorized access to internal resources that the application normally has access to, potentially compromising sensitive data or system integrity.
Mitigation strategies should prioritize immediate patching of the affected AstrBot version to 4.25.3 or later, which presumably contains the necessary security fixes. Network segmentation and firewall rules should be implemented to restrict access to the vulnerable API endpoints where possible. Input validation must be strengthened at the application layer to ensure all URL parameters are properly sanitized and validated against expected formats before being used in HTTP requests. Additionally, implementing network monitoring solutions that can detect unusual outbound traffic patterns may help identify exploitation attempts. The ATT&CK framework categorizes this vulnerability under T1190 - Proxy Execution, as it allows attackers to use legitimate system processes to execute malicious requests. Organizations should also consider implementing web application firewalls and regular security assessments to prevent similar vulnerabilities from being introduced in future deployments. Given the vendor's lack of response to early disclosure, organizations should treat this as a critical issue requiring immediate attention through internal remediation efforts rather than waiting for vendor-provided patches.