{"id":"GO-2026-5678","revision":null,"records":[{"revision":"0c2392c2875d4577bb18ef639461c4dc","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-101084","aliases":[],"title":"obot before v0.21.1 Authorization Bypass via /mcp-connect","description":"obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.","state":0,"publishedAt":"2026-09-27T20:49:56.702+00:00","modifiedAt":"2026-09-30T22:12:50.861+00:00","affected":[{"ecosystem":"Vendor product","name":"obot","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"obot-platform\",\n                    \"product\": \"obot\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/obot-platform/obot\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.21.1\"\n                        },\n                        {\n                            \"version\": \"0.21.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp","https://www.vulncheck.com/advisories/obot-before-0.21.1-authorization-bypass-via-mcp-connect"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-101084","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-101084","identifiers":["CVE-2026-101084"]},"retained":false,"historicalAffected":[]},{"revision":"7d4582abdd044872bb33df666de9131d","observedAt":"2026-11-11T05:28:02.045+00:00","statement":{"source":"euvd","id":"EUVD-2026-88029","aliases":["CVE-2026-101084","GHSA-g524-9c6h-8w7v"],"title":"obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to…","description":"obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":9.3,"severity":null}],"references":["https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp","https://www.vulncheck.com/advisories/obot-before-0.21.1-authorization-bypass-via-mcp-connect"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88029","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 27, 2026, 8:49:56 PM","dateUpdated":"Sep 30, 2026, 10:12:50 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-88029","identifiers":["EUVD-2026-88029","CVE-2026-101084","GHSA-g524-9c6h-8w7v"]},"retained":false,"historicalAffected":[]},{"revision":"fdb35672a7f44c9fb9c4259ebf1435f4","observedAt":"2026-10-25T04:17:26.915+00:00","statement":{"source":"nvd","id":"CVE-2026-101084","aliases":[],"title":"obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to…","description":"obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.","state":0,"publishedAt":"2026-09-27T21:17:02.163+00:00","modifiedAt":"2026-09-30T23:16:57.46+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp","https://www.vulncheck.com/advisories/obot-before-0.21.1-authorization-bypass-via-mcp-connect"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101084","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-639"],"productCriteria":[],"sourceDates":{"published":"2026-09-27T21:17:02.163","lastModified":"2026-09-30T23:16:57.460"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-101084","identifiers":["CVE-2026-101084"]},"retained":false,"historicalAffected":[]},{"revision":"c1f306bb7aae4e2280e1948648319eaf","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-vw82-7fv8-r6gp","aliases":["CVE-2026-101084","GO-2026-5678"],"title":"Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server","description":"## Summary\n\nIf you have the MCP Server ID, you can connect to the MCP server even if you don't have permissions to the server.\n\nThe MCP gateway endpoint `/mcp-connect/{mcp_id}` does not enforce Access Control Rules (ACRs). Any authenticated Obot user who possesses an MCP Server ID can connect to that server through the gateway — including making tool calls — regardless of whether they are a member of any MCP Registry that grants access to the server.\n\nIn practice this means any User can fully use MCP servers that the administrator believed were restricted to specific groups.\n\n## Severity\n\nReporter estimate: **Critical**.\n\n| CVSS 3.1 metric | Value |\n|---|---|\n| Attack Vector | Network |\n| Attack Complexity | Low |\n| Privileges Required | Low (authenticated Obot user, any role ≥ Basic) |\n| User Interaction | None |\n| Scope | Changed (Obot authorization bypass enables access to data and operations on an upstream third-party service via Obot's stored OAuth credentials) |\n| Confidentiality | High |\n| Integrity | High (many MCP servers expose write tools — e.g. `updateEmployee`, `submitTimeoffRequest`, ticket creation, file writes) |\n| Availability | None |\n| **Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N` |\n| **Score** | **9.3 / Critical** |\n\nThe upstream impact depends on which MCP servers are deployed and what scope their stored credentials hold; the bound is \"everything the platform's stored OAuth/API credentials can reach.\"\n\n## Affected Versions\n\nConfirmed on `obot v0.21.0`.\n\n## Vulnerability Details\n\nThe intended flow is that a user's authorization is checked during the OAuth process with Obot.\n\n1. The user connects to an MCP URL through Obot.\n2. During the callback, after the user logs into Obot, Obot checks that the user has access to the provided resource (the `/mcp-connect` URL in this case). Obot correctly determines the user's authorization during this flow.\n3. However, another authorization check (the UI authorizer, in this case) was erroneously providing access.\n\n## Reproduction\n\nTested on `obot v0.21.0`.\n\n**Setup:**\n\n1. Configure a multi-user MCP server connected to a sensitive backend — e.g. an HR system, ticketing system, or any service whose stored OAuth token grants broad read/write access. Note its ID.\n4. Create an MCP Registry / Access Control Rule that grants this server **only** to a small group (e.g. two HR employees). Remove the `everyone` group from the relevant rule.\n5. Create or identify a Basic User who is **not** a member of any registry granting access to this server.\n\n**Exploit:**\n\n6. Sign in as the Basic User.\n7. Verify the UI does not list the server in any connector picker (it does not — that path is correctly gated).\n8. Manually craft and call the gateway URL:\n\n   ```\n   POST https://<obot>/mcp-connect/<mcp_server_id>\n   Authorization: <session cookie or API key>\n   Content-Type: application/json\n\n   {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}\n   ```\n\n9. Observe a successful response listing the server's tools.\n10. Issue an actual tool call:\n\n   ```json\n   {\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\n    \"params\":{\"name\":\"<sensitive_tool>\",\"arguments\":{...}}}\n   ```\n\n11. Observe the call succeeds, returning data scoped only by the **upstream** MCP server's OAuth credentials — not by Obot's ACRs.\n\nThe exploit works equally well via Claude Desktop / Claude Code / any MCP-aware client by configuring the gateway URL as a remote MCP endpoint with the user's API key.","state":0,"publishedAt":"2026-05-13T15:32:11+00:00","modifiedAt":"2026-09-28T11:55:34.4042711+00:00","affected":[{"ecosystem":"Go","name":"github.com/obot-platform/obot","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.21.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp","https://github.com/obot-platform/obot","https://github.com/obot-platform/obot/releases/tag/v0.21.1"],"sourceUrl":"https://github.com/advisories/GHSA-vw82-7fv8-r6gp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vw82-7fv8-r6gp","identifiers":["GHSA-vw82-7fv8-r6gp","CVE-2026-101084","GO-2026-5678"]},"retained":false,"historicalAffected":[]},{"revision":"06562a76cf5d43c4802d4ed043b5e43f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5678","aliases":["CVE-2026-101084","GHSA-vw82-7fv8-r6gp"],"title":"Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot","description":"Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-09-28T11:55:34.4042711+00:00","affected":[{"ecosystem":"Go","name":"github.com/obot-platform/obot","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.21.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp","https://github.com/obot-platform/obot/releases/tag/v0.21.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5678","license":"OSV · upstream source license applies","key":"osv:GO-2026-5678","identifiers":["GO-2026-5678","CVE-2026-101084","GHSA-vw82-7fv8-r6gp"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T01:56:45.7331196+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T01:56:45.7331196+00:00","lastSuccessAt":"2026-11-12T01:56:45.8811913+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:56:45.881192+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-3c214c6a32247ab2d1d3b316a538911dff65582c6da8e67b65c52a6524920b32","complete":true,"records":424535,"lastAttemptAt":"2026-11-12T01:56:45.0952496+00:00","lastSuccessAt":"2026-11-12T01:56:45.0811877+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:56:45.0952496+00:00","snapshotPublishedAt":"2026-11-12T01:20:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bcc8684b65174110b8807dc4d8b03322","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T02:06:55.9169023+00:00","lastSuccessAt":"2026-11-12T02:06:55.913+00:00","error":"671 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-12T02:06:55.913+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":12946,"expectedIdentifiers":13813,"failedIdentifiers":671},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T01:56:45.7331196+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T01:56:45.7331196+00:00","lastSuccessAt":"2026-11-12T01:56:45.8819472+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:56:45.8819473+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-94eaf194888848508d3f9f54dac1b6ce","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T01:57:11.1206168+00:00","lastSuccessAt":"2026-11-12T01:57:11.117+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:57:11.117+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T01:56:45.5143298+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:56:45.5143298+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T01:56:45.2815945+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:56:45.2815945+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T01:56:45.6894904+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:56:45.6894904+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-12T01:56:45.3885824+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:56:45.3885824+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}