CVE-2026-95930: iFlytek astron-agent SSRF Vulnerability

CVE-2026-95930 Overview

CVE-2026-95930 is a Server-Side Request Forgery (SSRF) vulnerability in iFlytek astron-agent versions up to 1.0.6. The flaw resides in the UrlCheckTool.checkUrl function exposed through the debugToolV2 API endpoint. An authenticated remote attacker can manipulate the endPoint argument to coerce the server into issuing arbitrary HTTP requests. This class of weakness is tracked as [CWE-918]. The maintainers have addressed the issue in release reward-1575 via commit 45ee5fb647e9894e73b0d7720fa94a66e4540bbb.

Critical Impact
Remote attackers with low-privileged access can abuse the vulnerable endpoint to reach internal services, cloud metadata endpoints, or arbitrary external hosts through the affected server.

Affected Products

iFlytek astron-agent versions up to and including 1.0.6
debugToolV2 API endpoint component
UrlCheckTool.checkUrl function in core/plugin/link/infra/tool_exector/process.py

Discovery Timeline

2026-09-23 - CVE CVE-2026-95930 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95930

Vulnerability Analysis

The vulnerability exists in astron-agent, an open-source agent framework maintained by iFlytek. The debugToolV2 API endpoint invokes UrlCheckTool.checkUrl, which accepts a user-supplied endPoint parameter. The function forwards the value into an outbound HTTP request without adequately restricting the destination. Because the request is issued by the server, an attacker can direct traffic to hosts and network segments that are not directly reachable from the internet. Typical SSRF impact includes exposure of internal APIs, retrieval of cloud instance metadata, and interaction with unauthenticated administrative services.

Root Cause

The root cause is missing validation and allow-listing of the destination URL in UrlCheckTool.checkUrl. In addition, the underlying aiohttp client session followed HTTP redirects by default, allowing an attacker-controlled endpoint to bounce the server into internal targets even when a first-hop filter is applied. The combination of unrestricted destination input and permissive redirect handling produces the SSRF condition.

Attack Vector

Exploitation requires network access to the vulnerable API and low-privileged authentication. An attacker submits a crafted request to the debugToolV2 endpoint, supplying an endPoint value that references an internal address (for example http://169.254.169.254/) or an attacker-controlled server that returns a redirect to an internal target. The server then issues the outbound request and returns response data or side-effect indicators to the attacker.

python

         }
 
         async with aiohttp.ClientSession() as session:
-            async with session.request(self.method, url, **kwargs) as response:
+            async with session.request(
+                self.method, url, allow_redirects=False, **kwargs
+            ) as response:
                 response_text = await response.text()
                 status_code = response.status

Source: GitHub Commit 45ee5fb. The patch disables automatic redirect following in the outbound aiohttp request, reducing one class of SSRF pivot.

Detection Methods for CVE-2026-95930

Indicators of Compromise

Outbound HTTP requests from the astron-agent service to internal RFC1918 ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
Access log entries for the debugToolV2 API endpoint containing suspicious endPoint parameter values referencing internal hostnames or non-standard URL schemes.
Unexpected DNS resolution activity originating from the application host for attacker-controlled domains.

Detection Strategies

Inspect application logs for calls to UrlCheckTool.checkUrl where the endPoint argument targets private IP space, link-local addresses, or unusual ports.
Correlate egress network telemetry with process context to identify the astron-agent service issuing anomalous outbound requests.
Deploy web application firewall rules that reject requests to debugToolV2 containing URL parameters resolving to internal ranges.

Monitoring Recommendations

Alert on any outbound traffic from application servers to cloud metadata service IPs.
Baseline normal destination hosts for the astron-agent workload and flag deviations.
Track version and commit hash of deployed astron-agent instances to confirm patched builds are running.

How to Mitigate CVE-2026-95930

Immediate Actions Required

Upgrade astron-agent to release reward-1575 or later, which contains commit 45ee5fb647e9894e73b0d7720fa94a66e4540bbb.
Restrict network egress from hosts running astron-agent to only the destinations required for legitimate operation.
Require authentication and authorization checks on the debugToolV2 endpoint and limit access to trusted operators.

Patch Information

The fix is available in the GitHub Release reward-1575. The change disables automatic redirect following in the aiohttp client call within core/plugin/link/infra/tool_exector/process.py. Additional context is available in GitHub Issue #1323 and GitHub Pull Request #1338.

Workarounds

Block the debugToolV2 endpoint at the reverse proxy or API gateway until the upgrade is deployed.
Enforce an outbound allow-list on the application host that denies traffic to RFC1918, loopback, and link-local addresses including 169.254.169.254.
Add input validation at an upstream proxy to reject endPoint parameters that resolve to internal IP ranges.

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -m owner --uid-owner astron -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner astron -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner astron -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner astron -d 192.168.0.0/16 -j REJECT