[ Vendor · 10 CVEs ]
obot-platform
CVEs affecting obot-platform published in the last 30 days, plus any obot-platform CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114662 | 22 Oct 2026 | CVSS 8.1 | obot-platform obotObot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by… | |
| CVE-2026-105139 | 7 Oct 2026 | CVSS 4.3 | obot-platform obotObot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts… | |
| CVE-2026-105140 | 7 Oct 2026 | CVSS 4.2 | obot-platform obotObot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just… | |
| CVE-2026-105138 | 7 Oct 2026 | CVSS 6.5 | obot-platform obotObot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set… | |
| CVE-2026-103758 | 1 Oct 2026 | CVSS 8.1 | obot-platform obotObot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI… | |
| CVE-2026-101065 | 27 Sep 2026 | CVSS 9.8 | obot-platform obotObot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the… | |
| CVE-2026-101084 | 27 Sep 2026 | CVSS 9.6 | obot-platform obotobot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to… | |
| CVE-2026-101062 | 27 Sep 2026 | CVSS 8.8 | obot-platform obotObot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration… | |
| CVE-2026-101063 | 27 Sep 2026 | CVSS 5.3 | obot-platform obotObot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled… | |
| CVE-2026-101064 | 27 Sep 2026 | CVSS 7.6 | obot-platform obotObot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify… |