CVE-2026-33769

CVE-2026-33769 is a medium severity vulnerability affecting the Astro web framework (versions 2.10.10 to 5.18.0) where unanchored wildcard matching in remotePatterns path enforcement allows for a remote allowlist bypass. This flaw enables an unauthenticated attacker to fetch paths outside an intended allowlisted prefix on an otherwise permitted host, resulting in a low confidentiality impact (CVSS 5.3). The attack vector is network-based with low complexity and requires no user interaction. There is currently no evidence of active exploitation, public exploit code, or significant community attention, as indicated by its very low EPSS score and absence from the KEV catalog.