CVE-2026-105138

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105138
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105138.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105138
Aliases
  • GHSA-q5wf-87f5-cxgq
Published
2026-10-07T12:18:32Z
Modified
2026-10-09T02:47:55Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Details

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105138.json"
}
References

Affected packages

Git / github.com/obot-platform/obot

Affected ranges

Type
GIT
Repo
https://github.com/obot-platform/obot
Events
Introduced
7649be272402cc3e2ecfa51db874fb6fbf271b9f
Fixed
cf4337b8966c8e76a6e5e896c8f122a8fa4e3305
Fixed
644a1fd60a66125ced3de10b350a983e933def7a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.12.0"
        },
        {
            "fixed": "0.26.2"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v.*
v.0.23.2-rc1
v0.*
v0.12.0
v0.13.0
v0.13.0-rc1
v0.13.0-rc2
v0.15.0
v0.15.0-rc1
v0.15.1
v0.15.1-rc1
v0.16.0
v0.16.0-rc1
v0.16.1
v0.16.2
v0.17.0
v0.17.0-rc1
v0.17.0-rc2
v0.17.1
v0.18.0
v0.18.0-rc1
v0.18.1
v0.18.2-rc1
v0.19.0
v0.19.0-rc1
v0.20.0
v0.20.0-rc1
v0.20.0-rc2
v0.20.1
v0.21.0
v0.21.0-rc1
v0.21.0-rc2
v0.22.0
v0.22.0-alpha1
v0.22.0-alpha2
v0.22.0-alpha3
v0.22.0-alpha4
v0.22.0-alpha5
v0.22.0-alpha6
v0.22.0-alpha7
v0.22.0-alpha8
v0.22.0-rc1
v0.22.0-rc2
v0.22.0-rc3
v0.22.1
v0.23.0
v0.23.0-rc1
v0.23.0-rc2
v0.23.0-rc3
v0.23.0-rc4
v0.23.0-rc5
v0.23.1
v0.24.0
v0.24.1
v0.25.0
v0.25.0-rc1
v0.25.1
v0.26.0
v0.26.0-alpha1
v0.26.0-rc1
v0.26.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105138.json"