[ CVE-2026-101063 · Published 27 Sep 2026 ]
Vulnerability in obot-platform obot
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.