CVE-2026-101084

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-101084

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101084.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-101084

Aliases

Published

2026-09-27T20:49:56Z

Modified

2026-09-29T03:45:47Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

obot before v0.21.1 Authorization Bypass via /mcp-connect

Details

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101084.json"
}

References

Affected packages

Git / github.com/obot-platform/obot

Affected ranges

Type

GIT

Repo

https://github.com/obot-platform/obot

Events

Introduced

Fixed

2a2ec3f23ac564b2e2fab6b09fdef4ecd05fd496

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.21.1"
        },
        {
            "fixed":  "v0.21.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.0-rc1

v0.1.0-rc2

v0.1.0-rc3

v0.1.0-rc4

v0.10.0

v0.11.0

v0.11.0-rc1

v0.12.0

v0.12.0-rc1

v0.13.0

v0.13.0-rc1

v0.13.0-rc2

v0.15.0

v0.15.0-rc1

v0.15.1

v0.15.1-rc1

v0.16.0

v0.16.0-rc1

v0.16.1

v0.16.2

v0.17.0

v0.17.0-rc1

v0.17.0-rc2

v0.17.1

v0.18.0

v0.18.0-rc1

v0.18.1

v0.18.2-rc1

v0.19.0

v0.19.0-rc1

v0.2.0

v0.2.0-rc1

v0.2.1

v0.20.0

v0.20.0-rc1

v0.20.0-rc2

v0.20.1

v0.21.0

v0.21.0-rc1

v0.21.0-rc2

v0.21.1-rc1

v0.21.1-rc2

v0.3.0

v0.4.0

v0.4.0-rc1

v0.5.0

v0.5.1

v0.5.2

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.0

v0.8.0-rc1

v0.8.0-rc2

v0.8.0-rc3

v0.9.0

v0.9.0-rc1

v0.9.1-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101084.json"