CVE-2026-101063 Obot before v0.23.0 Authentication Bypass via Registry API

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

CVE-2026-101062 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CVE-2026-101063 Obot before v0.23.0 Authentication Bypass via Registry API

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

CVE-2026-101063 Obot before v0.23.0 Authentication Bypass via Registry API

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

CVE-2026-101062: Incorrect Authorization

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

PT-2026-99711

Name of the Vulnerable Software and Affected Versions Obot versions up to and including commit d7e6970 Description The Docker quickstart command starts the container listening on 0.0.0.0:8080 with authentication disabled by default. In this state, every request is mapped to a synthetic "nobody"...

CVE-2026-101084: Authorization Bypass Through User-Controlled Key

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

CVE-2026-101065: Missing Authentication for Critical Function

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When authentication is disabled, every request is mapped...

CVE-2026-101064: Server-Side Request Forgery (SSRF)

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and clo...

CVE-2026-101063: Missing Authorization

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

Obot: Server-Side Request Forgery via remote MCP server URL

Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint 169.254.169.254, so a use wi...

GHSA-JGH3-FGGC-MCPM Obot: Server-Side Request Forgery via remote MCP server URL

Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint 169.254.169.254, so a use wi...

GHSA-PR6H-VR44-XQ8J Obot: MCP Registry API readable without authentication

Summary In affected versions, enabling registry authentication OBOTSERVERENABLEREGISTRYAUTH=true does not actually protect the MCP Registry endpoints under /v0.1/ — they remain readable by unauthenticated callers. Am I affected? You are affected if you run Obot = v0.22.1 with...

Obot: MCP Registry API readable without authentication

Summary In affected versions, enabling registry authentication OBOTSERVERENABLEREGISTRYAUTH=true does not actually protect the MCP Registry endpoints under /v0.1/ — they remain readable by unauthenticated callers. Am I affected? You are affected if you run Obot = v0.22.1 with...

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivered...

GHSA-XWMW-PRC4-V3CR Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivered...

PT-2026-99709

Name of the Vulnerable Software and Affected Versions Obot versions prior to 0.23.0 Description When registry authentication is enabled via the OBOT SERVER ENABLE REGISTRY AUTH variable, the software fails to enforce authentication on MCP Registry endpoints under the /v0.1/ path. This occurs...

PT-2026-102290

Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint 169.254.169.254, so a use wi...

PT-2026-99708

Name of the Vulnerable Software and Affected Versions Obot versions prior to 0.23.0 Description When running with OBOT SERVER ENABLE AUTHENTICATION=true, the software exposes OAuth dynamic client registration without authentication and without restrictions on redirect URIs. This allows an...

PT-2026-99710

Name of the Vulnerable Software and Affected Versions Obot versions prior to 0.23.0 Description Obot contains a server-side request forgery SSRF issue during remote MCP server registration. Privileged users with Power User, Power User Plus, or Admin roles can specify arbitrary URLs in the...