CVE-2026-6118 Details.
AstrBot <= 4.22.1 - Command Injection
Atlas does not check this one. Needs an outside server.
To test for this one, the site would have to contact a server outside your network and report back. Atlas does not run checks that need that, so it does not run this one.
About CVE-2026-6118. What It Means.
AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any validation or allowlist enforcement. An attacker with dashboard access can execute arbitrary system commands with AstrBot process privileges.
Affected Product. What Is Hit.
- Vendor
- astrbotdevs
- Product
- Astrbotdevs AstrBot
References. Where To Read More.
FAQ
Common Questions.
AstrBot <= 4.22.1 - Command Injection. AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any validation or allowlist enforcement. An attacker with dashboard access can execute arbitrary system commands with AstrBot process privileges.
No. To test for this one, the site would have to contact a server outside your network and report back. Atlas does not run checks that need that, so it does not run this one. The facts about CVE-2026-6118 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-6118 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Astrbotdevs AstrBot to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-6118. Atlas does not run a check for it, so nothing here says whether a particular site is affected.