AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Summary
AstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin.
Details
AstrBot uses a hard-coded JWT signing key, which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python plugin that will be imported here, enabling arbitrary command execution on the target host.
Impact
All publicly accessible AstrBot instances are vulnerable.
For more information, please see: CVE-2025-55449-AstrBot-RCE
Patch
This vulnerability was first reported on 2025-06-21 and was patched on the same day (2025-06-21).
The vulnerability was publicly disclosed on 2025-11-14. Prior to public disclosure, monitoring from AstrBot Cloud indicated that fewer than 2% of deployed instances were still running the affected version. Therefore, this disclosure is not expected to have a significant impact on existing active instances.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | astrbot | < 3.5.18 | 3.5.18 |
References
- https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-4m32-cjv7-f425
- https://nvd.nist.gov/vuln/detail/CVE-2025-55449
- https://github.com/AstrBotDevs/AstrBot/commit/d03e9fb90a0921a1bd10cf480bdacc9aaa246472
- https://github.com/AstrBotDevs/AstrBot
- https://github.com/AstrBotDevs/AstrBot/releases/tag/v3.5.18
- https://github.com/Marven11/CVE-2025-55449-AstrBot-RCE
- https://pypi.org/project/astrbot
- https://github.com/advisories/GHSA-4m32-cjv7-f425
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-321, CWE-345, CWE-798- Platform
- Python (PyPI)
- Package
astrbot- Disclosed
- 14.11.2025
- Updated
- 11.10.2026 12:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4m32-cjv7-f425 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-285 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: astrbot
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 06.2025 06.2026
- Without a fix
- 5
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 3
- Medium 1
- Low 3
Disclosures per year
- 2025: 4
- 2026: 4
-
AstrBot is vulnerable to RCE with hard-coded JWT signing keys this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.