Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-101063Obot before v0.23.0 Authentication Bypass via Registry API

Medium 5.3

In plain English

A medium-severity missing authorization in obot from obot-platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 84.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/obot-platform/obot	0.23.0	GHSA-pr6h-vr44-xq8j
Go	github.com/obot-platform/obot	0.23.0	GO-2026-6525

Affected products (as reported)

Vendor	Product	Versions
obot-platform	obot	0 – before 0.23.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-pr6h-vr44-xq8j) vendor-advisory
VulnCheck Advisory: Obot before v0.23.0 Authentication Bypass via Registry API third-party-advisory