Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-101084

obot before v0.21.1 Authorization Bypass via /mcp-connect

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

obot-platform obot

Default version status: unaffected

  • 0 to < 0.21.1affected
  • 0.21.1unaffected
pkg:golang/github.com/obot-platform/obot

References