cyfenced.com →

[ CVE-2026-105139 · Published 7 Oct 2026 ]

Vulnerability in obot-platform obot

CVSS 4.3 EPSS <1%No fix listed yet

[ Description ]Official description

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates through the vMCP owner's shared component connection.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References