Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-95930: iFlytek astron-agent up to 1.0.6 allows remote URL request hijack

CVE-2026-95930 · published 1 month ago

Summary

The debugToolV2 feature in iFlytek astron-agent (versions up to 1.0.6) can be tricked into contacting any web address you choose, letting an attacker make the server request external sites on their behalf. This could be used to bypass security controls or gather internal information. Update the software to the newer release that includes the fix.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
iflytek	astron-agent	1.0.0

Original advisory text

iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded.

References

https://github.com/iflytek/astron-agent/ URL
https://vuldb.com/cve/CVE-2026-95930 Vendor Advisory
https://vuldb.com/submit/953331 Vendor Advisory
https://vuldb.com/vuln/408552 Vendor Advisory
https://github.com/iflytek/astron-agent/issues/1323 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95930... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-95930 Vendor Advisory
https://vuldb.com/vuln/408552/cti Third Party Advisory
https://github.com/iflytek/astron-agent/commit/45ee5fb647e9894e73b0d7720fa94a66e... Patch
https://github.com/iflytek/astron-agent/pull/1338 Patch
https://github.com/iflytek/astron-agent/releases/tag/reward-1575 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published23 Sep 2026

Updated4 Nov 2026

First seen23 Sep 2026

Sources

CVE-2026-95930 · NVD

CVE-2026-95930 · OSV

CVE-2026-95930 · MITRE

Track software like this

Free during beta