CVE-2026-17529: AstrBot Authorization Bypass Vulnerability

CVE-2026-17529 Overview

CVE-2026-17529 is an incorrect authorization vulnerability [CWE-285] in AstrBotDevs AstrBot versions up to 4.25.5. The flaw resides in an unknown function within astrbot/core/astr_main_agent.py, where manipulation of the req.func_tool argument bypasses persona tool boundaries. Attackers can trigger the issue remotely with low-privilege authenticated access. Public exploit details are available, increasing the likelihood of opportunistic abuse against exposed AstrBot deployments. The maintainers addressed the issue in commit d23011262e8e75e1ec41b0f1f0091493a022327e.

Critical Impact
Authenticated remote attackers can invoke tools outside their assigned persona boundaries, breaking the intended authorization model of the AstrBot agent framework.

Affected Products

AstrBotDevs AstrBot versions up to and including 4.25.5
The astrbot/core/astr_main_agent.py component
The astrbot/core/astr_agent_tool_exec.py tool execution path

Discovery Timeline

2026-07-27 - CVE-2026-17529 published to NVD
2026-07-27 - Last updated in NVD database
Patch commit - d23011262e8e75e1ec41b0f1f0091493a022327e merged via Pull Request #8786

Technical Details for CVE-2026-17529

Vulnerability Analysis

AstrBot is an AI chat agent framework that exposes tools to large language models based on the active persona configuration. The authorization defect allows a caller to supply a req.func_tool value that references tools outside the persona's approved toolset. The agent then executes the requested tool without validating that it belongs to the current persona's allowed scope.

The original implementation iterated over llm_tools.func_list and only excluded HandoffTool instances. Every remaining active tool was added to the runtime toolset, regardless of persona restrictions. This granted callers effective access to the full tool inventory once they held any valid session privilege.

Root Cause

The root cause is missing enforcement of persona-scoped tool boundaries during tool resolution. The pre-patch logic in _apply_persona_and_skills returned None implicitly and never propagated the set of tool names that the persona actually permitted. Downstream code in astr_agent_tool_exec.py therefore had no allow-list to consult when materializing the ToolSet.

Attack Vector

The attack requires network access and low-level authenticated privileges to the AstrBot interface. An attacker submits a crafted request with a req.func_tool value pointing to a tool that should be restricted by persona configuration. Because tool selection is unfiltered, the agent invokes the tool, resulting in low-impact confidentiality, integrity, and availability effects on the agent's data and actions.

python

         # "all tools", including runtime computer-use tools.
         if tools is None:
             toolset = ToolSet()
-            for registered_tool in llm_tools.func_list:
-                if isinstance(registered_tool, HandoffTool):
+            handoff_names = {
+                tool.name
+                for tool in tool_mgr.func_list
+                if isinstance(tool, HandoffTool)
+            }
+            for registered_tool in tool_mgr.get_full_tool_set():
+                if registered_tool.name in handoff_names:
                     continue
                 if registered_tool.active:
                     toolset.add_tool(registered_tool)

Source: GitHub Commit d2301126. The patch replaces the broad func_list iteration with a persona-scoped get_full_tool_set() call and computes an explicit handoff_names exclusion set.

Detection Methods for CVE-2026-17529

Indicators of Compromise

Requests to AstrBot API endpoints containing func_tool values that do not match the caller's persona configuration.
Tool invocation log entries where the executed tool name is absent from the persona's declared skill list.
Unexpected outbound activity or file operations initiated by AstrBot workers immediately following crafted agent requests.

Detection Strategies

Compare each tool execution event against the persona-to-tool mapping defined in AstrBot configuration and alert on mismatches.
Enable verbose logging in astrbot/core/astr_agent_tool_exec.py to record the resolved ToolSet per request for auditability.
Review Git history against commit d23011262e8e75e1ec41b0f1f0091493a022327e to confirm the patched code path is present in deployed instances.

Monitoring Recommendations

Track EPSS scoring for CVE-2026-17529, currently 0.358% at the 28.54 percentile, and re-evaluate as public exploitation signals evolve.
Monitor authentication logs for low-privilege accounts issuing high volumes of agent requests referencing multiple distinct tools.
Alert on new outbound network destinations originating from AstrBot processes that were not observed prior to a suspect request.

How to Mitigate CVE-2026-17529

Immediate Actions Required

Upgrade AstrBot to a release that includes commit d23011262e8e75e1ec41b0f1f0091493a022327e from Pull Request #8786.
Restrict network exposure of AstrBot management and agent endpoints to trusted networks or VPN only.
Rotate any credentials, API keys, or tokens accessible to AstrBot tools if unauthorized invocation is suspected.

Patch Information

The upstream fix is available in the AstrBot repository at GitHub Commit d2301126. Additional context is provided in GitHub Issue #8780 and VulDB CVE-2026-17529. Administrators should apply the patched release rather than backporting individual hunks.

Workarounds

Disable non-essential tools in the AstrBot configuration until the patched version is deployed.
Enforce the principle of least privilege on AstrBot user accounts and remove any accounts that do not require agent access.
Place AstrBot behind an authenticating reverse proxy that filters requests containing unexpected func_tool parameters.

bash

# Update AstrBot to the patched revision
cd /opt/AstrBot
git fetch origin
git checkout d23011262e8e75e1ec41b0f1f0091493a022327e
pip install -r requirements.txt
systemctl restart astrbot