CVE-2026-17529: 
AstrBot vulnerability analysis and mitigation

CVE-2026-17529 is an incorrect authorization vulnerability in AstrBotDevs AstrBot, an open-source AI agent chatbot platform. The flaw exists in astrbot/core/astr_main_agent.py and allows authenticated low-privileged users to bypass persona-level tool restrictions by manipulating the req.func_tool argument. Affected versions are AstrBot 4.25.0 through 4.25.5; the issue was reported on June 14, 2026, and publicly disclosed on July 27, 2026. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Github Advisory, Feedly).

The root cause is a tool-assembly ordering flaw classified as CWE-285 (Improper Authorization) / CWE-863 (Incorrect Authorization). In astrbot/core/astr_main_agent.py, persona restrictions are applied to req.func_tool early in the pipeline — a persona configured with tools=[] correctly yields an empty tool set at that point. However, several helper functions (_apply_web_search_tools, proactive messaging tool injection, and cron-related tool appends) are invoked after persona filtering and append built-in tools directly to req.func_tool without re-checking the persona allowlist. This means that when provider_settings.web_search=True with the Tavily backend, TavilyWebSearchTool and TavilyExtractWebPageTool are unconditionally added to the request even if the active persona explicitly disables all tools. The bypass is exploitable remotely by any authenticated operator via the documented /api/v1/chat HTTP interface (GitHub Issue #8780, GitHub PR #8786).

Successful exploitation allows a low-privileged authenticated attacker to invoke built-in tools — including web search (web_search_tavily, tavily_extract_web_page), proactive messaging (send_message_to_user), and potentially cron or computer-use tools — that the operator explicitly disabled for a given persona. This breaks the security boundary of persona-level tool policies, resulting in low-level confidentiality, integrity, and availability impacts on the vulnerable system. No subsequent system impact is expected, and lateral movement potential is limited, but the bypass undermines operator trust boundaries and could expose external services (e.g., web search APIs) to unauthorized invocation (GitHub Issue #8780, Github Advisory).

A proof-of-concept exploit was developed and verified end-to-end by the reporter using the standard Dashboard and /api/v1/chat APIs against a live AstrBot instance with a local OpenAI-compatible mock backend; PoC scripts (mock_openai_server.py, verification_test.py, control-no-late-tools.py) were referenced in the disclosure. The EPSS score is approximately 0.358% (29th percentile), indicating low near-term exploitation probability. There is no evidence of in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The NVD SSVC assessment classifies exploitation as "poc" with no automation and partial technical impact (Github Advisory, GitHub Issue #8780).

1. Authenticate: Log in to an AstrBot instance (versions 4.25.0–4.25.5) using a low-privileged operator account via the Dashboard at http://<host>:6185.
2. Create a restricted persona: Via the Dashboard API or UI, create a persona with tools=[] to explicitly disable all tools for that persona.
3. Enable web search: Ensure the AstrBot runtime configuration has provider_settings.web_search=True and websearch_provider=tavily (or another supported provider).
4. Bind persona to a conversation: Bind the tool-restricted persona to a target conversation session.
5. Send a crafted chat request: Issue a POST request to /api/v1/chat with a prompt designed to trigger tool invocation (e.g., a web search query). Despite the persona's tools=[] policy, the late-injected web_search_tavily and tavily_extract_web_page tools will be present in the outgoing LLM request.
6. Observe unauthorized tool execution: Confirm in astrbot_server.log that the agent logs Agent 使用工具: ['web_search_tavily'], and in the captured provider request log that the tools array includes the forbidden built-in tools — demonstrating the policy bypass (GitHub Issue #8780).

• Logs: astrbot_server.log entries containing Agent 使用工具: ['web_search_tavily'] or 使用工具：web_search_tavily when the active persona is configured with tools=[].
• Logs: Log entries showing Tool 'web_search_tavily' Result: Error: Tavily API key is not configured in contexts where web search tools should be disabled by persona policy.
• Network: Outgoing OpenAI-compatible API requests from the AstrBot server whose tools array includes web_search_tavily, tavily_extract_web_page, or send_message_to_user when a tool-restricted persona is active.
• Application: Provider request capture files (e.g., mock_openai_requests.jsonl) containing tool_names: ["web_search_tavily", "tavily_extract_web_page", "send_message_to_user"] for sessions bound to a tools=[] persona (GitHub Issue #8780).

Apply the patch introduced in commit d23011262e8e75e1ec41b0f1f0091493a022327e, which enforces persona tool allowlists after all late tool injections by re-filtering req.func_tool against the persona's allowed tool set before the final agent build. The fix was merged into the master branch on June 18, 2026, via PR #8786. Users should upgrade AstrBot to any version containing this commit (post-4.25.5). As a temporary workaround, disabling provider_settings.web_search and other late-injection features (proactive messaging, cron tools) reduces the attack surface until patching is possible (GitHub PR #8786, Github Advisory).

The vulnerability was reported by researcher YLChen-007 via a detailed GitHub issue on June 14, 2026, with a thorough end-to-end PoC and runtime evidence. AstrBot maintainer Soulter reviewed and merged the fix on June 18, 2026, after community member zouyonghe confirmed the patch approach was sound with no blocking issues. The fix was also backported by community fork KBVsent on July 13, 2026. No broader media coverage or significant social media discussion has been identified beyond the GitHub issue and PR threads (GitHub Issue #8780, GitHub PR #8786).