CVE-2026-95930: iFlytek astron-agent vulnerability

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded.

Description quoted from the CVE record (assigned by VulDB, published 2026-09-23).

Weakness: Server-Side Request Forgery

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing low privileges and no user interaction. Impact: confidentiality low, integrity low, availability low. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Exploit Observer found 3 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 6 references on Exploit Observer

Live scores

EPSS: 0.004
low predicted chance of attack
VEDAS: 0.987
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Suricata

Who is affected

Product	Affected	Not affected
iFlytek astron-agent	version 1.0.0 version 1.0.1 version 1.0.2 version 1.0.3 version 1.0.4 version 1.0.5 version 1.0.6	reward-1575 is not affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

https://github.com/iflytek/astron-agent/pull/1338 (issue-tracking, patch)
https://github.com/iflytek/astron-agent/commit/45ee5fb647e9894e73b0d7720fa94a66e4540bbb (patch)
https://github.com/iflytek/astron-agent/releases/tag/reward-1575 (patch)

How to detect it

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-95930 iFlytek astron-agent - Server-Side Request Forgery via debug-tool endPoint. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-95930 iFlytek astron-agent - Server-Side Request Forgery via debug-tool endPoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/tool/debug-tool"; nocase; fast_pattern; http.request_body; content:"endPoint"; nocase; pcre:"/https?(?:\x3a|%3a)(?:\x2f\x2f|%2f%2f)(?:127\.|0\.0\.0\.0|localhost|169\.254\.169\.254|metadata|10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|\x5b|%5b)/i"; classtype:web-application-attack; reference:cve,CVE-2026-95930; reference:url,https://www.exploit.observer/?keyword=CVE-2026-95930&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=astron-agent&match=exact; sid:1095403; rev:1;)

CVE-2026-95930.rules on GitHub

References

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.