Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-101063

Obot before v0.23.0 Authentication Bypass via Registry API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

obot-platform obot

Default version status: unaffected

  • 0 to < 0.23.0affected
  • 0.23.0unaffected
pkg:golang/github.com/obot-platform/obot

References