Is CVE-2026-15500 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15500 being exploited in the wild.

How severe is CVE-2026-15500?

Medium severity, with a CVSS score of 6.3, published 12 July 2026.

Is there a fix for CVE-2026-15500?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15500 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15500?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15500: AstrBotDevs AstrBot SSRF in market_list endpoint

CVE-2026-15500 · Severity: medium · CVSS 6.3 · Published 2026-07-12

AstrBot, a chatbot management platform, contains a security flaw in its plugin marketplace dashboard. An authenticated user can trick the server into making unauthorized network requests to internal systems or other websites. This could allow an attacker to scan internal networks, access private administrative interfaces, or interact with sensitive cloud metadata services that are normally protected from the outside world.

Quick answers

Is CVE-2026-15500 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15500 being exploited in the wild.
How severe is CVE-2026-15500?: Medium severity, with a CVSS score of 6.3, published 12 July 2026.
Which products and versions are affected?: AstrBotDevs AstrBot <= 4.25.2.
Is there a fix for CVE-2026-15500?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15500 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15500?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in AstrBot versions up to 4.25.2 within the `get_online_plugins` function in `astrbot/dashboard/routes/plugin.py`. The application accepts an untrusted `custom_registry` URL parameter via the `/api/plugin/market_list` endpoint and uses it directly in `aiohttp` requests without validation or filtering. An authenticated attacker can provide a malicious URL (including loopback or internal RFC1918 addresses) which the server will then fetch. The vulnerability also derives a second request to an MD5 endpoint based on the same attacker-controlled input. This allows for internal port scanning and interaction with services reachable only from the AstrBot host, such as cloud metadata endpoints or local management APIs. No patch was available at the time of disclosure.

Affected products

AstrBotDevs AstrBot <= 4.25.2

Timeline

2026-06-01: disclosed: Initial researcher disclosure via GitHub Gist
2026-07-12: advisory: NVD/VulDB publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.