CVE-2026-17529mediumCWE-285CWE-863

CVE-2026-17529: medium-severity vulnerability in AstrBotDevs AstrBot

AstrBotDevs AstrBot astr_main_agent.py authorization

Published

Follow this CVE+ Monitor AstrBot

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.4%
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is d23011262e8e75e1ec41b0f1f0091493a022327e. It is suggested to install a patch to address this issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
AstrBotDevs · AstrBot
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — AstrBotDevs AstrBot

In the same product, most dangerous first.

CVE-2026-6118MEDIUMAstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injectionEPSS 2.5%CVE-2025-48957HIGHAstrBot Has Path Traversal Vulnerability in /api/chat/get_fileEPSS 0.8%CVE-2026-16076MEDIUMAstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofingEPSS 0.5%CVE-2026-17530MEDIUMAstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorizationEPSS 0.4%CVE-2026-16075MEDIUMAstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorizationEPSS 0.4%CVE-2026-10213MEDIUMAstrBotDevs AstrBot API Endpoint delete path traversalEPSS 0.4%