Threats affecting pkg:github/obot-platform/obot

CVE-2026-114662 is a high-severity authentication bypass vulnerability in obot-platform's obot product before version 0.26.0. It allows unauthenticated attackers to steal API keys by exploiting the CLI login flow via crafted token request IDs. Attackers can create token requests, send login links to signed-in users, and retrieve non-expiring API keys to take over victim accounts. The issue is fixed in version 0.26.0.

CVE-2026-105140 is a race condition vulnerability in obot-platform's obot product affecting versions 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1. The flaw occurs during concurrent auth provider group refreshes, allowing revoked group memberships to be temporarily restored due to out-of-order commits. This results in users retaining revoked group-based access for approximately ten minutes.

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates through the vMCP owner's shared component connection.

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.

Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route. Basic-role users with a composite MCP ID can proxy requests through mcpGateway.Proxy to invoke tools on MCP servers restricted by Access Control Rules.

obot versions before 0.21.1 contain an authorization bypass vulnerability in the /mcp-connect endpoint. This flaw allows any authenticated user who knows a server ID to connect to restricted MCP servers without proper access control enforcement. Exploiting this issue enables attackers to access and manipulate sensitive backend systems via MCP tool calls using stored OAuth credentials. The vulnerability has a critical severity with a CVSS 4.0 score of 9.3.

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.

CVE-2026-101062 is a high-severity authorization vulnerability in obot-platform's obot product versions before 0.23.0. When OBOT_SERVER_ENABLE_AUTHENTICATION=true, the OAuth dynamic client registration endpoint is exposed without authentication or restrictions on redirect URIs. This allows an attacker to register a malicious client and trick a logged-in user into authorizing it, resulting in the attacker obtaining an access token with the victim's full group privileges. The token is accepted by obot APIs without proper audience validation, enabling unauthorized access to victim resources. Version 0.23.0 fixes this by adding a consent screen, restricting token scope to the MCP server, and enforcing audience validation.