Description
A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashboard/routes/plugin.py of the component market_list Endpoint. Executing a manipulation of the argument custom_registry can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-07-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the market_list endpoint of the AstrBot dashboard, specifically within the get_online_plugins function in plugin.py. An attacker can supply a crafted custom_registry argument that causes the AstrBot server to issue HTTP requests to arbitrary URLs. This server‑side request forgery (SSRF) could expose internal services, leak sensitive data, or serve as a foothold for further lateral attacks. The flaw is exploitable remotely and a public exploit has already been released.

Affected Systems

AstrBotDevs AstrBot versions up to 4.25.2 are affected. The weakness resides in the market_list endpoint within the astrbot/dashboard/routes/plugin.py component of the AstrBot application.

Risk and Exploitability

The CVSS base score of 5.3 indicates a moderate risk, while the EPSS score of less than 1% points to a low, yet non‑zero probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Because the attack vector is remote, the exploit has been publicly distributed, and the asset may be exposed to untrusted networks, the overall risk to systems remains material.

Generated by OpenCVE AI on August 1, 2026 at 11:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AstrBot to a version newer than 4.25.2.
  • Validate or whitelist the custom_registry parameter to prevent unintended outbound requests.
  • Apply network segmentation or firewall rules that restrict outbound traffic from the AstrBot server to trusted hosts.

Generated by OpenCVE AI on August 1, 2026 at 11:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 12 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashboard/routes/plugin.py of the component market_list Endpoint. Executing a manipulation of the argument custom_registry can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery
First Time appeared Astrbot
Astrbot astrbot
Weaknesses CWE-918
CPEs cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*
Vendors & Products Astrbot
Astrbot astrbot
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Astrbot Astrbot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-13T15:41:38.976Z

Reserved: 2026-07-11T12:41:58.125Z

Link: CVE-2026-15500

cve-icon Vulnrichment

Updated: 2026-07-13T15:41:35.307Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T11:15:03Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)