CVE-2026-101063, CoreCVE

Back Back to CVE browser

MEDIUM

Obot before v0.23.0 Authentication Bypass via Registry API

Published Sep 27, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.24%

Description

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.

Affected products

Vendor Obot-Platform Product Obot Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <0.23.0
- Version
  0.23.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Obot-Platform

Obot

unaffected

Version	Status	Constraints
0	affected	<0.23.0
0.23.0	unaffected	-

Ecosystem	Package	Introduced	Fixed
Go	github.com/obot-platform/obot	0	0.23.0

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://github.com/obot-platform/obot/security/advisories/GHSA-pr6h-vr44-xq8j
vendor-advisory
https://www.vulncheck.com/advisories/obot-before-0.23.0-authentication-bypass-via-registry-api
third-party-advisory

Link	Providers	Tags
https://github.com/obot-platform/obot/security/advisories/GHSA-pr6h-vr44-xq8j		vendor-advisory
https://www.vulncheck.com/advisories/obot-before-0.23.0-authentication-bypass-via-registry-api		third-party-advisory