CVE-2026-10211: AstrBot Authentication Bypass Vulnerability

CVE-2026-10211 Overview

CVE-2026-10211 is an incorrect authorization vulnerability in AstrBotDevs AstrBot version 4.23.6. The flaw resides in the _normalize_rw_path function within astrbot/core/tools/computer_tools/fs.py. Manipulating this path normalization logic allows an authenticated remote attacker to bypass intended access controls on the file system layer used by AstrBot's computer tools. The issue is classified under [CWE-285] Improper Authorization. A public proof-of-concept has been disclosed, and the vendor did not respond to the reporter's outreach prior to publication.

Critical Impact

Authenticated remote attackers can bypass authorization checks in AstrBot's read/write path normalization, potentially accessing or modifying files outside intended boundaries.

Affected Products

• AstrBotDevs AstrBot 4.23.6
• Component: astrbot/core/tools/computer_tools/fs.py
• Function: _normalize_rw_path

Discovery Timeline

• 2026-06-01 - CVE-2026-10211 published to the National Vulnerability Database (NVD)
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10211

Vulnerability Analysis

The vulnerability sits inside AstrBot's file system abstraction used by its computer tools subsystem. The _normalize_rw_path helper is responsible for resolving and validating paths supplied to read/write operations. Because the normalization step does not correctly enforce the intended authorization boundary, callers can supply crafted path inputs that resolve to locations outside the permitted scope.

The attack is network reachable and requires low privileges, since AstrBot exposes these tools to authenticated users of the bot platform. Exploitation does not require user interaction. Confidentiality, integrity, and availability impacts are limited in scope but real, as the authorization check is the only barrier preventing unauthorized file access through the affected function.

Root Cause

The root cause is improper authorization [CWE-285] in _normalize_rw_path. The function normalizes paths before performing read/write actions, but the comparison or containment check used to confirm the resolved path remains within the authorized directory is insufficient. As a result, the function returns a usable path even when the caller targets resources outside the intended boundary.

Attack Vector

An attacker with low-privilege access to the AstrBot instance issues requests through the computer tools interface that invoke file read or write operations. By supplying crafted path strings, including traversal sequences or absolute paths, the attacker reaches the vulnerable normalization routine. Because the function approves the resolved path, the subsequent file operation executes against attacker-chosen targets.

No verified exploit code is mirrored here. Refer to the publicly disclosed proof-of-concept on the GitHub Gist Code Snippet and the VulDB CVE-2026-10211 record for technical details.

Detection Methods for CVE-2026-10211

Indicators of Compromise

• Requests to AstrBot computer tool endpoints containing path traversal sequences such as ../ or absolute paths targeting locations outside the configured workspace.
• Unexpected file reads or writes performed by the AstrBot service account against system directories or other users' workspaces.
• AstrBot log entries showing _normalize_rw_path resolving to paths outside the configured root.

Detection Strategies

• Review AstrBot application logs for read/write operations whose resolved paths fall outside expected project or workspace directories.
• Monitor process and file telemetry for the AstrBot runtime accessing unusual paths such as /etc, user home directories, or configuration stores.
• Correlate authenticated AstrBot API sessions with file system activity to identify low-privilege users triggering broad file access.

Monitoring Recommendations

• Enable verbose logging of the AstrBot computer tools module and forward logs to a central analytics platform for review.
• Alert on any file write performed by AstrBot to directories outside its designated working tree.
• Track authentication events and pair them with file system audit records to surface authorization bypass attempts.

How to Mitigate CVE-2026-10211

Immediate Actions Required

• Restrict network exposure of AstrBot 4.23.6 to trusted users only until a fixed version is available.
• Run AstrBot under a dedicated low-privilege OS account with file system permissions limited to its required working directories.
• Audit existing AstrBot accounts and revoke credentials for users who do not require computer tool access.
• Review file system activity logs for evidence of prior exploitation of _normalize_rw_path.

Patch Information

At the time of publication, AstrBotDevs had not responded to the reporter and no official patch is referenced in the advisory. Monitor the AstrBot project on GitHub and the VulDB Vulnerability #367490 entry for updated fix information.

Workarounds

• Disable the computer tools feature in AstrBot configuration if it is not required for operational workflows.
• Place AstrBot inside a container or chroot with read-only mounts for sensitive paths and a tightly scoped writable workspace.
• Apply mandatory access controls such as AppArmor or SELinux profiles to restrict the AstrBot process to its intended directories.
• Add a reverse proxy or application firewall rule to block requests containing suspicious path traversal patterns to AstrBot endpoints.

# Example: restrict AstrBot to a dedicated workspace using systemd hardening
[Service]
User=astrbot
Group=astrbot
ReadWritePaths=/var/lib/astrbot/workspace
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true