CVE-2026-15500: AstrBot SSRF Vulnerability

CVE-2026-15500 Overview

CVE-2026-15500 is a server-side request forgery (SSRF) vulnerability in AstrBotDevs AstrBot through version 4.25.2. The flaw resides in the get_online_plugins function within astrbot/dashboard/routes/plugin.py, which handles requests to the market_list endpoint. An authenticated attacker can manipulate the custom_registry argument to force the AstrBot server to issue arbitrary HTTP requests to attacker-chosen destinations. The issue is classified under CWE-918: Server-Side Request Forgery. A public proof-of-concept has been published, and the vendor did not respond to the coordinated disclosure attempt.

Critical Impact
Authenticated remote attackers can coerce the AstrBot dashboard into making outbound requests to internal services, cloud metadata endpoints, or arbitrary hosts, enabling internal network reconnaissance and data exposure.

Affected Products

AstrBotDevs AstrBot versions up to and including 4.25.2
Component: astrbot/dashboard/routes/plugin.py
Endpoint: market_list (plugin marketplace listing)

Discovery Timeline

2026-07-12 - CVE-2026-15500 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15500

Vulnerability Analysis

AstrBot exposes a dashboard route that retrieves the list of available plugins from a plugin registry. The get_online_plugins handler accepts a client-supplied custom_registry parameter and uses it as the target URL for a server-initiated HTTP request. Because the parameter is not restricted to a trusted allow-list of hosts, the server will fetch content from any URL the attacker provides.

An attacker with valid low-privilege dashboard credentials can point custom_registry at internal-only services such as http://127.0.0.1, private RFC 1918 ranges, or cloud instance metadata services like http://169.254.169.254/latest/meta-data/. The response body, headers, or timing behavior returned by the AstrBot server can leak information about internal infrastructure. The vulnerability is exploitable remotely over the network without any user interaction.

Root Cause

The root cause is missing validation of a user-controlled URL passed to a server-side HTTP client. The custom_registry argument is trusted as-is and forwarded to the outbound request routine, with no scheme allow-list, no host allow-list, and no filtering of loopback, link-local, or private address ranges. This matches the classic SSRF pattern described in CWE-918.

Attack Vector

Exploitation requires network access to the AstrBot dashboard and a valid low-privilege session. The attacker sends a request to the market_list endpoint with custom_registry set to a chosen URL. The AstrBot server issues the request and returns the response to the caller. Public exploitation details are available in the GitHub Gist PoC Repository and the VulDB CVE-2026-15500 entry. No sanitized synthetic exploit code is reproduced here; refer to the linked advisories for request-level detail.

Detection Methods for CVE-2026-15500

Indicators of Compromise

Dashboard access logs containing requests to the market_list endpoint with a custom_registry parameter pointing to non-default hosts.
Outbound HTTP connections from the AstrBot process to 127.0.0.1, 169.254.169.254, or internal RFC 1918 ranges that were not previously observed.
DNS lookups from the AstrBot host for attacker-controlled domains referenced in custom_registry values.

Detection Strategies

Parse application logs for get_online_plugins invocations and alert when custom_registry differs from the configured default registry URL.
Instrument the AstrBot Python runtime or its reverse proxy to log all outbound URLs and flag requests targeting loopback, link-local, or private ranges.
Correlate authenticated dashboard sessions with unexpected outbound traffic patterns from the host to identify SSRF pivot attempts.

Monitoring Recommendations

Enable egress logging on the network segment hosting AstrBot and baseline legitimate destinations for the plugin marketplace.
Monitor cloud metadata endpoint access (169.254.169.254) from any AstrBot host, since this service should not normally be contacted by the dashboard.
Track repeated market_list requests from a single session that iterate through internal IP addresses or ports, which indicates SSRF-based scanning.

How to Mitigate CVE-2026-15500

Immediate Actions Required

Restrict network access to the AstrBot dashboard so it is not reachable from untrusted networks or the public internet.
Rotate and audit all AstrBot dashboard credentials, and remove low-privilege accounts that do not require access.
Apply strict egress filtering from AstrBot hosts to block outbound requests to loopback, link-local, and private address ranges.
Disable or block the market_list endpoint at a reverse proxy until a vendor patch is available.

Patch Information

At the time of publication, the vendor had not responded to the disclosure and no official fix is referenced in the NVD entry. Track the VulDB Vulnerability #377807 record and the AstrBotDevs project repository for updated releases. Once a patched version is published, upgrade beyond 4.25.2 and validate that custom_registry values are constrained to an allow-list.

Workarounds

Enforce an allow-list at a reverse proxy that only permits the official plugin registry hostname as a value for custom_registry.
Deploy AstrBot behind an egress proxy that denies requests to internal IP ranges and cloud metadata endpoints.
Remove the cloud instance metadata service exposure by enforcing IMDSv2 (AWS) or equivalent controls on the underlying compute host.
Require multi-factor authentication for all dashboard accounts to raise the cost of obtaining the low-privilege session required for exploitation.

bash

# Example nginx egress restriction in front of AstrBot dashboard
# Reject requests that supply custom_registry values outside the trusted host
location /dashboard/plugin/market_list {
    if ($arg_custom_registry !~* "^https://registry\.astrbot\.example/") {
        return 403;
    }
    proxy_pass http://astrbot_backend;
}