CVE-2026-17530: 
AstrBot vulnerability analysis and mitigation

CVE-2026-17530 is an incorrect authorization vulnerability in AstrBotDevs AstrBot affecting versions 4.25.0 through 4.25.5. The flaw resides in the _build_handoff_toolset function within astrbot/core/astr_agent_tool_exec.py in the Subagent component, allowing low-privileged authenticated users to bypass admin-enforced tool permission restrictions remotely. It was disclosed on July 27, 2026, with a patch commit (d23011262e8e75e1ec41b0f1f0091493a022327e) merged on June 18, 2026. The vulnerability carries a CVSS v3.1 score of 6.3 (Medium) and a CVSS v4.0 score of 2.1 (Low) (Github Advisory, Feedly).

The root cause is classified as CWE-285 (Improper Authorization) and CWE-863 (Incorrect Authorization). When a subagent is configured with tools: null (meaning "all tools"), the _build_handoff_toolset function reconstructs the child agent's toolset by iterating directly over the raw llm_tools.func_list instead of calling FunctionToolManager.get_full_tool_set(), which wraps non-builtin tools in the _PermissionGuardedTool proxy that enforces per-tool admin permission checks. As a result, raw MCPTool objects — including those explicitly marked as admin-only via the dashboard — are passed to the subagent without the permission guard, allowing a member-level user to invoke them via the public POST /api/v1/chat endpoint by triggering a transfer_to_worker handoff. The vulnerability was introduced alongside the per-tool permission management feature (commit ae44b912fc9153f6ecca1ecb0ac3bf0a6065e753) and was reported with a detailed end-to-end proof-of-concept (GitHub Issue #8781, GitHub PR #8786).

A low-privileged authenticated user (member or API chat user) can invoke MCP tools that operators have explicitly restricted to admin-only access, crossing both the chat trust boundary and the tool permission boundary without requiring local shell access or admin credentials. Depending on the MCP tools attached to the AstrBot instance, concrete impacts include unauthorized filesystem read/write (exposing secrets or modifying local state), execution of host commands or automation scripts (potentially enabling code execution), and abuse of external-system MCP tools to access downstream APIs, knowledge bases, CI/CD systems, or cloud resources. Confidentiality, integrity, and availability of the vulnerable system are all partially affected (GitHub Issue #8781, Github Advisory).

A proof-of-concept exploit was publicly released alongside the vulnerability disclosure, consisting of multiple Python scripts that demonstrate the full end-to-end bypass against a local AstrBot stack using only supported HTTP and dashboard APIs (GitHub Issue #8781). The EPSS score is approximately 0.358% (29th percentile), indicating a relatively low but non-negligible probability of exploitation in the wild within 30 days (Github Advisory). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires low-privilege authenticated access but no user interaction, and is not automatable according to NVD SSVC assessment (Feedly).

1. Obtain member-level access: Acquire a low-privileged member or API chat user account on a target AstrBot instance running versions 4.25.0–4.25.5 with subagent orchestration and MCP tools configured.
2. Identify admin-restricted MCP tools: Through the dashboard or by probing the chat API, identify non-builtin MCP tools that have been marked as admin-only via the WebUI → Extension → Components permission settings.
3. Configure or identify a subagent with tools: null: Locate or trigger a subagent persona whose configuration has tools set to null (meaning "all tools"), which causes _build_handoff_toolset to rebuild the toolset from raw llm_tools.func_list without permission guards.
4. Trigger a handoff via the chat API: Send a crafted POST /api/v1/chat request using the member-level API key with a prompt designed to cause the main agent to invoke transfer_to_worker, handing off execution to the vulnerable subagent.
5. Invoke the admin-restricted tool: The subagent, now holding raw (unguarded) MCPTool objects, executes the admin-restricted tool (e.g., a filesystem write tool or external API tool) on behalf of the low-privileged user, bypassing the permission boundary entirely.
6. Observe results: Confirm exploitation by observing MCP CallToolRequest log entries and the tool's side effects (e.g., a canary file written to disk, external API calls made) (GitHub Issue #8781).

• Logs: AstrBot logs showing [MCPServer-<name>] Processing request of type CallToolRequest for admin-restricted tools triggered by non-admin user sessions; log entries showing Agent 使用工具: ['transfer_to_worker'] followed immediately by Agent 使用工具: ['<admin_tool_name>'] from a member-level user context.
• Network: Unexpected POST /api/v1/chat requests from member-level API keys that result in MCP tool invocations; outbound connections from the AstrBot process to external MCP server endpoints not expected for member users.
• File System: Unexpected files created or modified by the AstrBot process in locations associated with MCP tool actions (e.g., canary files, modified configuration files, or data exfiltration artifacts).
• Process: Unusual child processes spawned by AstrBot's MCP stdio server processes (e.g., shell commands, file operations) triggered outside of admin sessions (GitHub Issue #8781).

Apply the patch commit d23011262e8e75e1ec41b0f1f0091493a022327e (merged via PR #8786 on June 18, 2026), which fixes _build_handoff_toolset to retrieve tools from tool_mgr.get_full_tool_set() instead of raw llm_tools.func_list, ensuring _PermissionGuardedTool wrappers are preserved for subagent handoffs. Users should update to a version of AstrBot that includes this commit (post-4.25.5 master branch). As an interim workaround if patching is not immediately possible, restrict network access to the AstrBot instance, avoid configuring subagents with tools: null (use explicit tool allowlists instead), and limit the number of users with member-level API access (GitHub PR #8786, Github Advisory).

The vulnerability was reported by researcher YLChen-007 via a detailed GitHub issue with a full end-to-end PoC, and was reviewed and acknowledged by AstrBot maintainer zouyonghe, who confirmed the patch approach was focused and had no blocking issues. Maintainer Soulter merged the fix on June 18, 2026, after code review by Sourcery AI and Gemini Code Assist bots. The issue received moderate community attention given AstrBot's 39,000+ GitHub stars, but no significant broader media coverage has been identified (GitHub Issue #8781, GitHub PR #8786).