CVE-2026-17530
Received Received - Intake

Incorrect Authorization in AstrBot via Subagent Component

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulDB

Description
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as d23011262e8e75e1ec41b0f1f0091493a022327e. A patch should be applied to remediate this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-17530
EUVD
EUVD-2026-49333

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
astrbotdevs astrbot 4.25.5
astrbotdevs astrbot From 4.25.5 (exc)
astrbotdevs astrbot to 4.25.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect authorization flaw in AstrBot up to version 4.25.5. It allows low-privileged users or API chat users to bypass admin-restricted tools by exploiting a subagent handoff bypass. The issue occurs because the subagent handoff path rebuilds its toolset from raw llm_tools.func_list instead of using the already permission-guarded toolset, enabling unauthorized access to admin-only tools.

Detection Guidance

Detecting this vulnerability requires checking if AstrBot is running a vulnerable version (up to 4.25.5) and if the exposed /api/v1/chat endpoint allows unauthorized tool access. Inspect logs for unusual MCP tool invocations or admin-restricted tool usage by non-admin users. Verify if the patch commit d23011262e8e75e1ec41b0f1f0091493a022327e is applied.

Impact Analysis

The impact depends on the attached MCP tools, which could include filesystem operations, host commands, or external system interactions. Attackers may perform unauthorized actions without requiring local shell access, source modifications, or admin privileges at exploit time. The vulnerability crosses chat trust and tool permission boundaries.

Compliance Impact

This vulnerability allows unauthorized access to admin-restricted tools through a subagent handoff bypass, which could lead to unauthorized data access, modification, or exfiltration depending on attached tools. This may violate GDPR's data protection principles (Article 5) and HIPAA's access controls (45 CFR § 164.308(a)(4)), as unauthorized users could perform actions like filesystem operations or external service interactions without proper permissions.

Mitigation Strategies

Apply the patch commit d23011262e8e75e1ec41b0f1f0091493a022327e immediately. Restrict access to the /api/v1/chat endpoint to trusted users only. Review and update persona tool permissions to ensure non-builtin tools are not accessible to low-privileged users. Monitor for unauthorized tool usage in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17530. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart