Race condition in Obot restores revoked group membership
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Obot from 0.25.0 before 0.25.6 and from 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes (CWE-362). When overlapping refreshes for the same user commit out of order, stale group memberships are saved, and the user keeps group-based access for about ten minutes after the group was revoked in the identity provider. An attacker needs a low-privileged account and must win the timing race. The CVSS 4.0 vector rates confidentiality and integrity impact as low and availability impact as none.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| obot-platform | obot | 0.25.0 to before 0.25.6; 0.26.0 to before 0.26.1 | 0.25.6, 0.26.1 | Patch available | CNA |
- obot Vendorobot-platform Affected 0.25.0 to before 0.25.6; 0.26.0 to before 0.26.1 Fixed in 0.25.6, 0.26.1 Patch available CNA
Remediation
Upgrade Obot to version 0.25.6 or 0.26.1, which fix the issue. The sources do not list a vendor advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA obot (obot-platform) Fixed in 0.25.6, 0.26.1
Timeline
- 2026-10-07 Threatist record created from CVE-2026-105140
- 2026-10-07 CISA SSVC decision points changed
References
Patch 2
Other 5
- https://github.com/obot-platform/obot
- obot v0.26.1 Release Notes
- https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/group.go#L652-L734
- https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/identity.go#L444-L456
- https://github.com/obot-platform/obot/blob/6f81dac8d344cf6b2161f500460fb7b2a975c415/pkg/gateway/client/group.go#L741-L757
More obot-platform vulnerabilities
- TI-2026-65117 obot before v0.21.1 Authorization Bypass via /mcp-connect CVSS 4.0CRITICAL 9.3
- TI-2026-65098 Obot Quickstart Docker Deployment Unauthenticated Admin Access CVSS 4.0CRITICAL 9.3
- TI-2026-65095 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration CVSS 4.0HIGH 8.7
- TI-2026-65757 Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route CVSS 4.0HIGH 8.6
- TI-2026-79161 Authentication bypass in Obot CLI login exposes API keys CVSS 4.0HIGH 8.6
- TI-2026-65097 Obot before v0.23.0 Server-Side Request Forgery via MCP CVSS 4.0HIGH 8.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences