CVE-2026-101064

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-101064

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101064.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-101064

Aliases

Published

2026-09-27T20:49:55Z

Modified

2026-09-29T03:45:46Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N CVSS Calculator

Summary

Obot before v0.23.0 Server-Side Request Forgery via MCP

Details

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101064.json"
}

References

Affected packages

Git / github.com/obot-platform/obot

Affected ranges

Type

GIT

Repo

https://github.com/obot-platform/obot

Events

Introduced

Fixed

1d4b687e66fce41dd059e1005501623e021ac27f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.23.0"
        },
        {
            "fixed":  "v0.23.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.0-rc1

v0.1.0-rc2

v0.1.0-rc3

v0.1.0-rc4

v0.10.0

v0.11.0

v0.11.0-rc1

v0.12.0

v0.12.0-rc1

v0.13.0

v0.13.0-rc1

v0.13.0-rc2

v0.15.0

v0.15.0-rc1

v0.15.1

v0.15.1-rc1

v0.16.0

v0.16.0-rc1

v0.16.1

v0.16.2

v0.17.0

v0.17.0-rc1

v0.17.0-rc2

v0.17.1

v0.18.0

v0.18.0-rc1

v0.18.1

v0.18.2-rc1

v0.19.0

v0.19.0-rc1

v0.2.0

v0.2.0-rc1

v0.2.1

v0.20.0

v0.20.0-rc1

v0.20.0-rc2

v0.20.1

v0.21.0

v0.21.0-rc1

v0.21.0-rc2

v0.22.0

v0.22.0-alpha1

v0.22.0-alpha2

v0.22.0-alpha3

v0.22.0-alpha4

v0.22.0-alpha5

v0.22.0-alpha6

v0.22.0-alpha7

v0.22.0-alpha8

v0.22.0-rc1

v0.22.0-rc2

v0.22.0-rc3

v0.22.1

v0.23.0-rc1

v0.23.0-rc2

v0.23.0-rc3

v0.23.0-rc4

v0.23.0-rc5

v0.3.0

v0.4.0

v0.4.0-rc1

v0.5.0

v0.5.1

v0.5.2

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.0

v0.8.0-rc1

v0.8.0-rc2

v0.8.0-rc3

v0.9.0

v0.9.0-rc1

v0.9.1-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101064.json"