CVE-2026-101063: Missing Authorization in obot-platform obot
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.
AI Analysis
Technical Summary
Obot versions prior to 0.23.0 do not enforce authentication on MCP Registry endpoints under the /v0.1/* path when registry authentication is enabled. This missing authorization allows unauthenticated attackers to access registry metadata including server names, descriptions, repository URLs, and connect URLs by issuing GET requests to /v0.1/servers. The vulnerability is identified as CVE-2026-101063 with a CVSS 4.0 score of 6.9 (medium severity).
Potential Impact
Unauthenticated attackers can retrieve sensitive registry metadata from the MCP Registry endpoints, potentially exposing information about servers and repositories. However, the vulnerability does not allow modification or deletion of data, nor does it require privileges or user interaction. The impact is limited to information disclosure.
Mitigation Recommendations
A fixed version 0.23.0 or later should be used to remediate this vulnerability. Versions before 0.23.0 are affected. Since no vendor advisory or patch link is provided, users should upgrade to version 0.23.0 or later where authorization enforcement on MCP Registry endpoints is implemented.
CVE-2026-101063: Missing Authorization in obot-platform obot
Description
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.
CVSS v4.0
Score 6.9medium
Affected software
obot-platform
obot
pkg:github/obot-platform/obotRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Obot versions prior to 0.23.0 do not enforce authentication on MCP Registry endpoints under the /v0.1/* path when registry authentication is enabled. This missing authorization allows unauthenticated attackers to access registry metadata including server names, descriptions, repository URLs, and connect URLs by issuing GET requests to /v0.1/servers. The vulnerability is identified as CVE-2026-101063 with a CVSS 4.0 score of 6.9 (medium severity).
Potential Impact
Unauthenticated attackers can retrieve sensitive registry metadata from the MCP Registry endpoints, potentially exposing information about servers and repositories. However, the vulnerability does not allow modification or deletion of data, nor does it require privileges or user interaction. The impact is limited to information disclosure.
Mitigation Recommendations
A fixed version 0.23.0 or later should be used to remediate this vulnerability. Versions before 0.23.0 are affected. Since no vendor advisory or patch link is provided, users should upgrade to version 0.23.0 or later where authorization enforcement on MCP Registry endpoints is implemented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-27T16:38:56.428Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab98494f7a7c541067b9767
Added to database: 09/27/2026, 21:03:16 UTC
Last enriched: 09/27/2026, 21:18:24 UTC
Last updated: 09/28/2026, 02:25:45 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.