CVE-2026-6118 AstrBotDevs CVE debrief

Who should care

Defenders responsible for AstrBot installations, especially those with remote access enabled, should assess exposure and prioritize verification of affected versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that their environments are protected against this vulnerability.

Why it matters

Defenders should prioritize verifying the affected versions and assessing exposure of AstrBot installations, especially those with remote access enabled, due to the publicly disclosed exploit and potential for command injection.

• Verify AstrBot installations for exposure to command injection
• Assess the impact of potential exploitation on the MCP Endpoint
• Monitor for potential exploitation attempts

Technical summary

The vulnerability is located in the add_mcp_server function of the astrbot/dashboard/routes/tools.py file, which is part of the MCP Endpoint. The manipulation of the command argument leads to command injection. The attack can be carried out remotely. This issue affects AstrBot up to version 4.22.1. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. Defenders should prioritize verifying affected versions and assessing exposure of AstrBot installations.

Defensive priority

Defenders should prioritize verifying the affected versions and assessing exposure of AstrBot installations, especially those with remote access enabled.

Recommended defensive actions

• Verify AstrBot installations for exposure, especially those with remote access enabled
• Assess the impact of command injection on the MCP Endpoint
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the vendor's response and remediation efforts are unknown. The vulnerability is in the add_mcp_server function of astrbot/dashboard/routes/tools.py, allowing remote command injection. Defenders should verify affected versions and assess exposure, especially with remote access enabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.