Skip to content
OpenAdvisories

Vendor

obot-platform

10 known vulnerabilities.

Products

obot 10
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.1
    CVE-2026-114662

    Obot before 0.26.0 API Key Theft via CLI Login Token Request

    Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login li…

    obot-platform obot
  • High 8.1
    CVE-2026-103758

    Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route

    Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route. Basic-role users with a composite MCP ID can proxy requests t…

    obot-platform obot
  • High 7.6
    CVE-2026-101064

    Obot before v0.23.0 Server-Side Request Forgery via MCP

    Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make…

    obot-platform obot github.com/obot-platform/obot Go
  • High 8.8
    CVE-2026-101062

    Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

    Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authori…

    obot-platform obot github.com/obot-platform/obot Go