{"id":"CVE-2025-55449","kind":"vulnerability","aliases":["CVE-2025-55449","GHSA-4m32-cjv7-f425"],"related":[],"title":"AstrBot is vulnerable to RCE with hard-coded JWT signing keys","description":"### Summary\nAstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin.\n\n### Details\n\nAstrBot uses a [hard-coded JWT signing key](https://github.com/AstrBotDevs/AstrBot/blob/v3.5.16/astrbot/core/__init__.py), which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python plugin that will be imported [here](https://github.com/AstrBotDevs/AstrBot/blob/master/astrbot/dashboard/routes/plugin.py), enabling arbitrary command execution on the target host.\n\n### Impact\n\nAll publicly accessible AstrBot instances are vulnerable.\n\nFor more information, please see: [CVE-2025-55449-AstrBot-RCE](https://github.com/Marven11/CVE-2025-55449-AstrBot-RCE)\n\n### Patch\n\nThis vulnerability was first reported on **2025-06-21** and was patched on the **same day** (2025-06-21).\n\nThe vulnerability was publicly disclosed on **2025-11-14**. Prior to public disclosure, monitoring from AstrBot Cloud indicated that fewer than 2% of deployed instances were still running the affected version. Therefore, this disclosure is not expected to have a significant impact on existing active instances.","summary":"AstrBot signs its dashboard login tokens with a hard-coded key that is public in the source code. An attacker can forge an admin token, install a malicious Python plugin, and execute arbitrary commands on the host.","severity":"critical","cvss":9.8,"epss":0.00281,"exploited":false,"exploited_at":null,"products":[{"name":"astrbot","fixed":["3.5.18"],"affected":"< 3.5.18","ecosystem":"pypi"},{"name":"astrbot","fixed":[],"affected":"= 3.5.15","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["astrbot","cwe-321","cwe-345","cwe-798","package","pypi","python","self-hosted"],"not_affected_if":["dashboard-not-exposed","patched-version"],"how_to_check":"- Run `pip show astrbot` and confirm the installed version is below `3.5.18`\n- Check whether the dashboard is reachable from the internet or an untrusted network","fix":"- Upgrade the `astrbot` package to `3.5.18` or later\n- Rotate any credentials or secrets on hosts that ran an affected version with a reachable dashboard","status":"open","published_at":"2025-11-14T21:52:23+00:00","first_seen_at":"2026-10-27T15:18:29+00:00","triaged_at":"2026-10-27T15:18:56+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-27T15:18:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `astrbot` package to `3.5.18` or later\n- Rotate any credentials or secrets on hosts that ran an affected version with a reachable dashboard","reach":"internet","title":"AstrBot: hard-coded JWT signing key lets attackers run commands via plugins","impact":"high","summary":"AstrBot signs its dashboard login tokens with a hard-coded key that is public in the source code. An attacker can forge an admin token, install a malicious Python plugin, and execute arbitrary commands on the host.","category":"package","nicknames":[],"who_cares":["python","pypi","self-hosted","astrbot"],"confidence":0.85,"needs_auth":"no","worst_case":"Attacker runs arbitrary commands on the AstrBot host","analyst_note":"Verify the affected-version range and the exact dashboard exposure condition from the GHSA advisory at https://github.com/advisories/GHSA-4m32-cjv7-f425.","how_to_check":"- Run `pip show astrbot` and confirm the installed version is below `3.5.18`\n- Check whether the dashboard is reachable from the internet or an untrusted network","needs_analyst":true,"not_affected_if":["patched-version","dashboard-not-exposed"],"who_is_affected":"Any AstrBot instance below `3.5.18` whose dashboard is publicly reachable is exposed, because the forged token grants plugin installation. Instances that only listen on localhost or sit behind strict network access controls are much less exposed. The advisory says fewer than 2% of deployed instances were still on the affected version before disclosure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000668,"input_tokens":3735,"output_tokens":589,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-06':174C,184C '-11':193C '-14':194C '-2025':14A,22A,158C '-21':175C,185C '-321':28B '-345':30B '-55449':15A,23A,159C '-798':32B '/astrbotdevs/astrbot/blob/master/astrbot/dashboard/routes/plugin.py),':135C '/astrbotdevs/astrbot/blob/v3.5.16/astrbot/core/__init__.py),':110C '/marven11/cve-2025-55449-astrbot-rce)':165C '2':207C '2025':173C,183C,192C '4m32':18A 'access':147C 'activ':230C 'admin':63B 'affect':215C 'allow':87C,112C 'arbitrari':72B,91C,137C 'astrbot':1A,24A,25A,26B,39B,78C,99C,148C,161C,201C 'astrbot-rc':160C 'attack':59B,88C,113C,122C 'authent':117C 'bypass':115C,120C 'cjv7':19A 'cloud':202C 'code':9A,49B,57B,83C,104C 'command':73B,92C,138C 'cve':13A,21A,157C 'cwe':27B,29B,31B 'dashboard':42B 'day':182C 'deploy':209C 'detail':98C 'disclos':190C 'disclosur':198C,219C 'enabl':136C 'execut':71B,90C,139C 'exist':229C 'expect':222C 'f425':20A 'fewer':205C 'first':170C 'forg':61B 'ghsa':17A 'ghsa-4m32-cjv7-f425':16A 'github.com':109C,134C,164C 'github.com/astrbotdevs/astrbot/blob/master/astrbot/dashboard/routes/plugin.py),':133C 'github.com/astrbotdevs/astrbot/blob/v3.5.16/astrbot/core/__init__.py),':108C 'github.com/marven11/cve-2025-55449-astrbot-rce)':163C 'hard':8A,48B,82C,103C 'hard-cod':7A,47B,81C,102C 'host':38B,76B,143C 'impact':144C,227C 'import':131C 'indic':203C 'inform':154C 'instal':65B,94C,124C 'instanc':149C,210C,231C 'jwt':10A,84C,105C 'key':12A,50B,86C,107C 'login':43B 'malici':67B,96C 'mechan':118C 'monitor':199C 'packag':33B 'patch':166C,178C 'pleas':155C 'plugin':69B,97C,127C 'prior':195C 'public':53B,146C,189C,197C 'pypi':34B 'python':35B,68B,126C 'rce':5A,162C 'report':171C 'run':213C 'see':156C 'self':37B 'self-host':36B 'sign':11A,40B,85C,106C 'signific':226C 'sourc':56B 'still':212C 'summari':77C 'target':142C 'therefor':217C 'token':44B,64B 'use':79C,100C 'version':216C 'vulner':3A,151C,168C,187C","nicknames":[],"mitigations":[],"who_affected":"Any AstrBot instance below `3.5.18` whose dashboard is publicly reachable is exposed, because the forged token grants plugin installation. Instances that only listen on localhost or sit behind strict network access controls are much less exposed. The advisory says fewer than 2% of deployed instances were still on the affected version before disclosure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-11-14T21:52:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4m32-cjv7-f425","url":"https://github.com/advisories/GHSA-4m32-cjv7-f425","severity":"critical","published_at":"2025-11-14T21:52:23+00:00","modified_at":"2026-10-27T15:17:57+00:00","first_seen_at":"2026-10-27T15:18:29+00:00","fetched_at":"2026-10-27T15:18:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-55449","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55449","severity":null,"published_at":"2026-05-08T07:16:28+00:00","modified_at":"2026-10-15T19:10:00+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}