Vendor
obot-platform
10 known vulnerabilities.
Products
4 results · Clear filters · Feed
-
Medium 4.3
Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources
Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access promp…
-
Medium 4.2
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale mem…
-
Medium 6.5
Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can reque…
-
Medium 5.3
Obot before v0.23.0 Authentication Bypass via Registry API
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connec…