CVE-2026-17530

MEDIUM

AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as d23011262e8e75e1ec41b0f1f0091493a022327e. A patch should be applied to remediate this issue.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-383395 | AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization
https://vuldb.com/vuln/383395
Signature, Permissions Required signature permissions-required
VDB-383395 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/383395/cti
Third Party Advisory third-party-advisory
CVE-2026-17530 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-17530
Third Party Advisory third-party-advisory
Submit #862536 | AstrBotDevs AstrBot [Needs Manual Input] (unreleased master branch after commit ae44b912) Incorrect Authorization (CWE-863)
https://vuldb.com/submit/862536

Scores

CVSS v3 6.3
EPSS 0.0036
EPSS Percentile 28.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-285 CWE-863
Status published
Products (6)
AstrBotDevs/AstrBot 4.25.0
AstrBotDevs/AstrBot 4.25.1
AstrBotDevs/AstrBot 4.25.2
AstrBotDevs/AstrBot 4.25.3
AstrBotDevs/AstrBot 4.25.4
AstrBotDevs/AstrBot 4.25.5
Published Jul 27, 2026
Tracked Since Jul 27, 2026