Description
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| obot-platform | obot | < 0.23.0 | 0.23.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/obot-platform/obot | < 0.23.0 | 0.23.0 | GHSA-pr6h-vr44-xq8j |
References
- GitHub Security Advisory (GHSA-pr6h-vr44-xq8j) vendor-advisory
- VulnCheck Advisory: Obot before v0.23.0 Authentication Bypass via Registry API third-party-advisory