CVE-2026-10212: AstrBot Authorization Bypass Vulnerability

CVE-2026-10212 Overview

CVE-2026-10212 is an authorization bypass vulnerability in AstrBotDevs AstrBot version 4.24.2. The flaw resides in the astr_main_agent function within astrbot/core/astr_main_agent.py. Manipulation of the session_id argument allows an authenticated remote attacker to bypass authorization controls and access resources tied to other sessions. The weakness is classified under [CWE-285] Improper Authorization. A proof-of-concept exploit is publicly available through a GitHub Gist and VulDB submission. According to the disclosure, the vendor was contacted ahead of public release but did not respond.

Critical Impact

Authenticated remote attackers can manipulate the session_id parameter to bypass authorization checks in AstrBot 4.24.2, gaining unauthorized access to session-scoped resources.

Affected Products

• AstrBotDevs AstrBot 4.24.2
• Function astr_main_agent in astrbot/core/astr_main_agent.py
• Deployments exposing AstrBot endpoints over the network

Discovery Timeline

• 2026-06-01 - CVE-2026-10212 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10212

Vulnerability Analysis

The vulnerability stems from missing or insufficient authorization enforcement in the astr_main_agent function. AstrBot uses the session_id argument to identify the agent session servicing a request. The function trusts caller-supplied session_id values without verifying that the authenticated principal owns or is permitted to access that session.

An attacker with low-privilege access can supply an arbitrary session_id and reach resources, conversation context, or agent actions associated with another user. The attack is remotely exploitable over the network and requires no user interaction. Impact is limited in scope to session-bound data and capabilities exposed by the agent.

Root Cause

The root cause is improper authorization [CWE-285]. The astr_main_agent code path accepts session_id as a parameter and uses it to retrieve or operate on session state without binding the value to the authenticated identity. There is no server-side check that the requesting user owns the referenced session.

Attack Vector

Exploitation requires network access to an AstrBot instance and a valid low-privilege account. The attacker submits requests that invoke astr_main_agent while substituting a target session_id. The application returns or operates on the targeted session data, completing the authorization bypass. A public proof-of-concept demonstrating the request flow is available in the referenced GitHub Gist.

No verified exploitation code is reproduced here. Refer to the GitHub Gist PoC and VulDB CVE-2026-10212 for technical details.

Detection Methods for CVE-2026-10212

Indicators of Compromise

• Requests to AstrBot endpoints that invoke astr_main_agent with session_id values not previously issued to the authenticated account.
• Sequential or enumerated session_id parameters originating from a single client.
• Access to session state immediately after authentication from accounts with no prior session activity.

Detection Strategies

• Compare the session_id parameter in inbound requests against the session ownership table for the authenticated user and alert on mismatches.
• Instrument astrbot/core/astr_main_agent.py to log the authenticated principal alongside the requested session_id for offline correlation.
• Apply rate and anomaly detection to identify accounts probing many distinct session_id values in a short interval.

Monitoring Recommendations

• Forward AstrBot application and access logs to a centralized analytics platform and retain them for incident review.
• Track 4xx and 5xx responses from agent endpoints to surface failed enumeration attempts.
• Review audit logs of agent actions tied to high-value sessions for unexpected source accounts.

How to Mitigate CVE-2026-10212

Immediate Actions Required

• Restrict network exposure of AstrBot 4.24.2 instances to trusted users and networks until a vendor fix is available.
• Require authentication for all agent endpoints and audit accounts that can reach astr_main_agent.
• Monitor public AstrBot repositories and VulDB entry #367491 for an upstream patch.

Patch Information

No vendor patch has been published at the time of this writing. The disclosure notes that AstrBotDevs did not respond to the coordinated disclosure attempt. Operators should track the AstrBot project and the VulDB advisory for fix availability.

Workarounds

• Add a server-side check that binds each session_id to the authenticated user and rejects requests where the binding fails.
• Place AstrBot behind a reverse proxy or API gateway that enforces per-user session scoping and blocks requests carrying foreign session_id values.
• Rotate session identifiers to unguessable values and shorten session lifetime to reduce the window for enumeration.

# Example reverse-proxy rule: reject requests where session_id does not match the authenticated user claim
# (pseudo-config, adapt to your gateway)
if ($http_x_user_id != $arg_session_owner) {
    return 403;
}