AstrBot Low-Privilege User Bypasses MCP Tool Permission Restrictions via Subagent Handoff

Vulnerability Overview Title: [Security] AstrBot subagent tools=null handoff bypass lets member users invoke admin-restricted MCP tools #8781 Description: A low-privileged member/API user can trigger a subagent with set to and access administrator-restricted, non-built-in tools via the public endpoint. The root cause is that the subagent handoff path reconstructs instead of reusing the already permission-protected toolset. This bypasses the dashboard's per-tool admin restrictions, potentially leading to unauthorized file system, host, or external service operations. Scope of Impact Affected Product: GitHub repository / Self-hosted application Package Name: AstrBot Affected Versions: Unreleased branch, introduced after commit (after v4.25.0) Severity: High Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/H:H/A:H Remediation 1. Call and filter out , or 2. Before adding tools to the subagent's toolset, wrap each tool in with . Proof of Concept (PoC) Code Log Evidence Additional Runtime Evidence Impact This is an authorization bypass vulnerability affecting deployments using AstrBot: Subagent orchestration Non-built-in tools such as MCP tools Administrator restrictions enforced via the dashboard Attackers can use member-level chat/API access to invoke tools explicitly reserved for operators/administrators. The specific impact depends on the attached tools. File system read/write MCP tools can expose secrets or modify local state Host command or automation MCP tools can serve as code execution primitives External system MCP tools can be used to access downstream APIs, knowledge bases, CI/CD systems, or cloud resources Since the entry point is the public chat API and the bypass crosses documented permission boundaries, this is more severe than a local configuration issue.

Goal Reached Thanks to every supporter — we hit 100%!

AstrBot Low-Privilege User Bypasses MCP Tool Permission Restrictions via Subagent Handoff

More from this source