CVE-2026-103758

The Obot platform, versions 0.21.1 through 0.24.1 , is vulnerable to an authorization bypass because the checkUI deny list fails to include the /mcp-connect-composite/ route. This flaw allows authenticated users with basic-role privileges and a composite MCP ID to proxy requests via mcpGateway.Pr...