CVE-2026-15501 is a server-side request forgery vulnerability in AstrBotDevs AstrBot affecting versions 4.25.0 through 4.25.2. The vulnerability exists in the ToolsRoute.test_mcp_connection function within astrbot/dashboard/routes/tools.py, specifically in the MCP Test Endpoint component. An attacker can manipulate the mcp_server_config.url parameter to cause the server to make unintended requests. The vulnerability is remotely exploitable without authentication or user interaction. Although the exploit has been publicly disclosed, the vendor has not issued any patch or official remediation.

Successful exploitation allows an attacker to induce the AstrBot server to make arbitrary HTTP requests, potentially accessing internal resources or services not directly reachable by the attacker. This can lead to information disclosure or further network reconnaissance. The vulnerability does not require user interaction and can be triggered remotely. However, the CVSS score of 5.3 indicates a medium impact level, reflecting limited scope or complexity of exploitation.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or provided remediation guidance, users should consider implementing network-level controls to restrict outbound requests from the affected component or apply application-level input validation and sanitization on the mcp_server_config.url parameter to prevent SSRF exploitation. Monitor for any future vendor advisories or patches and apply them promptly once available.