Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Obot before v0.23.0 lets anyone view registry data

CVE-2026-101063 · published 1 month ago
Summary

The Obot platform versions earlier than 0.23.0 do not require a login when accessing certain registry information, even if authentication is turned on. This means anyone on the network can see details about servers and repositories, which could expose internal service information. Upgrade to version 0.23.0 or later, or ensure the registry endpoints are blocked from unauthenticated access.

What to do
  • Update obot-platform obot to version 0.23.0 or later.
Affected software
VendorProductAffected versions
obot-platform obot < 0.23.0
Original advisory text
Obot before v0.23.0 Authentication Bypass via Registry API
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published27 Sep 2026
Updated4 Nov 2026
First seen27 Sep 2026
Sources
CVE-2026-101063 · NVD
CVE-2026-101063 · MITRE
Track software like this
Free during beta