Skip to content
OpenAdvisories

Package · Go

github.com/obot-platform/obot

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.6
    CVE-2026-101084

    obot before v0.21.1 Authorization Bypass via /mcp-connect

    obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipul…

    obot-platform obot github.com/obot-platform/obot Go
  • High 7.6
    CVE-2026-101064

    Obot before v0.23.0 Server-Side Request Forgery via MCP

    Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make…

    obot-platform obot github.com/obot-platform/obot Go
  • High 8.8
    CVE-2026-101062

    Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

    Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authori…

    obot-platform obot github.com/obot-platform/obot Go
  • Medium 5.3
    CVE-2026-101063

    Obot before v0.23.0 Authentication Bypass via Registry API

    Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connec…

    obot-platform obot github.com/obot-platform/obot Go