Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: obot-platform Clear all filters
TI-2026-79161 CVE-2026-114662 · GHSA-p9v9-jrq9-jpjv

Authentication bypass in Obot CLI login exposes API keys

Priority LOW 38

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00172 Published 2026-10-22 Fixed in 0.26.0 CWE-352
TI-2026-69120 CVE-2026-105140

Race condition in Obot restores revoked group membership

Priority LOW 11

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00179 Published 2026-10-07 Fixed in 0.25.6, 0.26.1 CWE-362
TI-2026-69119 CVE-2026-105139

Authorization bypass in Obot vMCP profiles exposes prompts and resources

Priority LOW 24

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00234 Published 2026-10-07 Fixed in 0.26.2 CWE-863
TI-2026-69118 CVE-2026-105138

Credential exposure via MCP catalog entry API in Obot

Priority LOW 31

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00263 Published 2026-10-07 Fixed in 0.26.2 CWE-522
TI-2026-65757 CVE-2026-103758 · GHSA-x6jv-4hp7-3vj9

Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route

Priority LOW 39

Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-01 No fix listed CWE-863
TI-2026-65117 CVE-2026-101084 · GHSA-g524-9c6h-8w7v

obot before v0.21.1 Authorization Bypass via /mcp-connect

Priority HIGH 75

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00346 Published 2026-09-27 Fixed in 0.21.1 CWE-639
TI-2026-65097 CVE-2026-101064 · GHSA-jvrr-x58p-75mm

Obot before v0.23.0 Server-Side Request Forgery via MCP

Priority LOW 36

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation.

CVSS 4.0HIGH 8.3 Network High privileges No interaction EPSS 0.00243 Published 2026-09-27 Fixed in 0.23.0 CWE-918
TI-2026-65096 CVE-2026-101063 · GHSA-63cq-34vq-4f48

Obot before v0.23.0 Authentication Bypass via Registry API

Priority LOW 36

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00244 Published 2026-09-27 Fixed in 0.23.0 CWE-862
TI-2026-65095 CVE-2026-101062 · GHSA-cfp9-746c-5jrw

Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Priority MEDIUM 40

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a c…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00336 Published 2026-09-27 Fixed in 0.23.0 CWE-863