CVE-2026-17529
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
AstrBotDevs AstrBot astr_main_agent.py authorization
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is d23011262e8e75e1ec41b0f1f0091493a022327e. It is suggested to install a patch to address this issue.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
AstrBot
- Vendor
- AstrBotDevs
- Product
- AstrBot
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.25.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 4.25.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 4.25.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 4.25.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 4.25.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 4.25.5 | affected | Unavailable | Unavailable | Unavailable | None listed |