Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: obot-platform obot 0.23.0 Clear all filters
TI-2026-65097 CVE-2026-101064 · GHSA-jvrr-x58p-75mm

Obot before v0.23.0 Server-Side Request Forgery via MCP

Priority LOW 36

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation.

CVSS 4.0HIGH 8.3 Network High privileges No interaction EPSS 0.00243 Published 2026-09-27 Fixed in 0.23.0 CWE-918
TI-2026-65096 CVE-2026-101063 · GHSA-63cq-34vq-4f48

Obot before v0.23.0 Authentication Bypass via Registry API

Priority LOW 36

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00244 Published 2026-09-27 Fixed in 0.23.0 CWE-862
TI-2026-65095 CVE-2026-101062 · GHSA-cfp9-746c-5jrw

Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Priority MEDIUM 40

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a c…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00336 Published 2026-09-27 Fixed in 0.23.0 CWE-863