AstrBot MCP Test Endpoint SSRF via mcp_server_config.url
First seen Jul 12, 2026 · Updated Jul 12, 2026 · CVSS 6.3
AstrBot's dashboard MCP connection test feature allows an attacker to supply an arbitrary URL that the server will fetch, resulting in server-side request forgery (SSRF). This could let an attacker probe internal networks, hit cloud metadata endpoints, or pivot against internal services from the AstrBot server. Exploit details are public and the vendor has not responded, increasing real-world risk.
Technical Analysis
The vulnerability resides in ToolsRoute.test_mcp_connection within astrbot/dashboard/routes/tools.py, which accepts a user-controlled mcp_server_config.url parameter meant to specify an MCP server endpoint for connectivity testing. Because the URL is not validated or restricted, an attacker can direct the AstrBot backend to make outbound requests to arbitrary internal or external hosts, including link-local metadata services (e.g., 169.254.169.254) or internal admin interfaces. The entry point is a dashboard API route, remotely reachable, effectively turning the 'MCP test connection' feature into a network pivot primitive. This crosses the boundary between the AI agent framework's control plane (dashboard) and internal network trust zones, and could be chained with credential theft from cloud metadata or further exploitation of internal MCP servers discovered via the SSRF.
Affected Systems
AstrBot; protocols: MCP
Detection Signatures
- Outbound requests from AstrBot dashboard host to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or 169.254.169.254 immediately following calls to /tools or MCP test-connection endpoints
- Log entries showing test_mcp_connection invoked with non-MCP-server URLs (e.g., file://, internal hostnames, cloud metadata IPs)
- Repeated or anomalous use of mcp_server_config.url parameter with unexpected schemes or ports
- Unusual DNS resolution requests originating from the AstrBot backend process shortly after dashboard API calls
Remediation Steps
- 1
Upgrade or patch AstrBot
Monitor AstrBotDevs repository for a patched release beyond 4.25.2 addressing this SSRF; apply as soon as available.
- 2
Restrict outbound network access
Apply network egress controls/firewall rules so the AstrBot server cannot reach internal-only services or cloud metadata endpoints from the dashboard host.
- 3
Validate and allowlist MCP server URLs
Implement strict URL validation on mcp_server_config.url, restricting to an allowlist of known/trusted MCP server hosts and disallowing internal IP ranges, localhost, and non-http(s) schemes.
- 4
Restrict dashboard access
Limit access to the AstrBot dashboard and its API routes to trusted internal users via authentication, network segmentation, or VPN, since this reduces the practical remote attack surface.
- 5
Disable or gate the test-connection feature
If a patch is unavailable, disable the MCP test connection endpoint or require elevated privileges/manual approval to use it until fixed.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.