CVE-2026-6119

AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery

View on CVE.org
Published Apr 12, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in AstrBotDevs AstrBot up to 4.22.1. The affected element is the function post_data.get of the component API Endpoint. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The function post_data.get in the AstrBot API endpoint enables an attacker to craft requests that the server will forward to any target within or outside the network. This can lead to unauthorized access to internal services, data exfiltration, or further compromise of internal resources. The vulnerability is a classic SSRF flaw, categorized under CWE‑918, and allows the attacker to influence outbound traffic initiated by the server.

Affected Systems

AstrBotDevs AstrBot versions up to and including 4.22.1 are affected. Users running any release within this range are vulnerable and should review their deployment for the presence of the impacted API endpoint.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity vulnerability. Publicly available proof‑of‑concept code exists, and the flaw can be exercised remotely via the API, implying a non‑trivial exploitation potential. EPSS data is not provided, and the vulnerability is not catalogued in the KEV list. The likely attack vector involves sending crafted payloads to the vulnerable endpoint from an exposed network or malicious actor controlling API traffic.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update AstrBot to a release newer than 4.22.1 as soon as a patch is available
  • If an upgrade cannot be performed immediately, restrict the API endpoint so that it only accepts requests from trusted IP ranges and block outbound requests to untrusted networks
  • Enable firewall or proxy rules to monitor and log all outbound HTTP/HTTPS traffic originating from the server
  • Apply least‑privilege principles to the API credentials used by AstrBot
  • Regularly consult the AstrBot issue tracker and vendor advisories for new security releases

Generated by OpenCVE AI on April 12, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in AstrBotDevs AstrBot up to 4.22.1. The affected element is the function post_data.get of the component API Endpoint. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery
First Time appeared Astrbot
Astrbot astrbot
Weaknesses CWE-918
CPEs cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*
Vendors & Products Astrbot
Astrbot astrbot
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 14, 2026, 4:33 PM
Reserved
Apr 11, 2026, 8:50 AM

View source JSON

Updated
Apr 14, 2026, 3:18 PM

JSON

Status
Deferred
Published
Apr 12, 2026, 6:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 13, 2026, 12:56 PM

JSON