CVE-2026-15501

MEDIUM 6.3

AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery

CVSS Score

6.3

EPSS Score

0.2%

EPSS Percentile

11th

A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the file astrbot/dashboard/routes/tools.py of the component MCP Test Endpoint. The manipulation of the argument mcp_server_config.url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-918
Vendor	astrbotdevs
Product	astrbot
Published	Jul 12, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for astrbotdevs astrbot

Be the first to know when new medium vulnerabilities affecting astrbotdevs astrbot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

AstrBotDevs / AstrBot

4.25.0 4.25.1 4.25.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/377808 vuldb.com: https://vuldb.com/vuln/377808/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15501 vuldb.com: https://vuldb.com/submit/844665 gist.github.com: https://gist.github.com/YLChen-007/b68732c140fb11d844b214cf2db50a5a

Credits

🔍 Eric-a (VulDB User) VulDB CNA Team