CVE-2026-17530

AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization

State: Published
Severity: 5.3 Medium
Published: Jul 27, 2026
Updated: Jul 27, 2026
Reserved: Jul 27, 2026

Description

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as d23011262e8e75e1ec41b0f1f0091493a022327e. A patch should be applied to remediate this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-863 Incorrect Authorization
CWE-285 Improper Authorization

Affected Products

Product	Versions
AstrBotAstrBotDevs	4.25.0Affected 4.25.1Affected 4.25.2Affected 4.25.3Affected 4.25.4Affected 4.25.5Affected

References

VDB-383395 | AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorizationvdb-entrytechnical-description
VDB-383395 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-17530 | CVE Analysis and Reportthird-party-advisory
Submit #862536 | AstrBotDevs AstrBot [Needs Manual Input] (unreleased master branch after commit ae44b912) Incorrect Authorization (CWE-863)third-party-advisory
https://github.com/AstrBotDevs/AstrBot/issues/8781exploitissue-tracking
https://github.com/AstrBotDevs/AstrBot/pull/8786issue-trackingpatch
https://github.com/AstrBotDevs/AstrBot/commit/d23011262e8e75e1ec41b0f1f0091493a022327epatch
https://github.com/AstrBotDevs/AstrBot/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.