CVE-2026-15501 is a server-side request forgery vulnerability affecting AstrBotDevs AstrBot up to version 4.25.2. The issue is located in the ToolsRoute.test_mcp_connection function within astrbot/dashboard/routes/tools.py, specifically in the MCP Test Endpoint component. An attacker can manipulate the mcp_server_config.url parameter to cause the server to make unauthorized requests, potentially leading to information disclosure or interaction with internal systems. The vulnerability is remotely exploitable without authentication or user interaction. The vendor has not provided a response or fix, and no patch links or remediation details are available.

Successful exploitation allows an attacker to induce the server to make arbitrary HTTP requests, potentially accessing internal or protected resources. This can lead to information disclosure or facilitate further attacks within the network. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, and no user interaction needed. No known exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, users should consider implementing network-level restrictions to limit the server's ability to make arbitrary outbound requests, such as firewall rules or proxy filtering. Monitor for unusual outbound traffic from the affected component. Check the vendor advisory regularly for updates or official fixes.