CVE-2026-101064

HIGHCVSS 7.6

Description

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.

Timeline

Published:September 27th, 2026 9:17 PM

Last modified:September 28th, 2026 9:02 PM

CVSS Scoring

CVSS v3: 7.6 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Weaknesses (CWE)

CWE-918

References & Reports

Advisories, patches, and third-party reports

https://github.com/obot-platform/obot/security/advisories/GHSA-jgh3-fggc-mcpm
https://www.vulncheck.com/advisories/obot-before-0.23.0-server-side-request-forgery-via-mcp

Source: NIST NVD · Data may lag official sources by up to one minute