obot before v0.21.1 Authorization Bypass via /mcp-connect

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

Source published

27 Sep 2026 20:49:56 UTC

Source modified

30 Sep 2026 22:12:50 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CVSS 3.1 · 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

Source published

Sep 27, 2026, 8:49:56 PM (timezone not stated)

Source modified

Sep 30, 2026, 10:12:50 PM (timezone not stated)

Observed here

11 Nov 2026 05:28:02 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

Source published

27 Sep 2026 21:17:02 UTC

Source modified

30 Sep 2026 23:16:57 UTC

Observed here

25 Oct 2026 04:17:26 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

## Summary If you have the MCP Server ID, you can connect to the MCP server even if you don't have permissions to the server. The MCP gateway endpoint `/mcp-connect/{mcp_id}` does not enforce Access Control Rules (ACRs). Any authenticated Obot user who possesses an MCP Server ID can connect to that server through the gateway — including making tool calls — regardless of whether they are a member of any MCP Registry that grants access to the server. In practice this means any User can fully use MCP servers that the administrator believed were restricted to specific groups. ## Severity Reporter estimate: **Critical**. | CVSS 3.1 metric | Value | |---|---| | Attack Vector | Network | | Attack Complexity | Low | | Privileges Required | Low (authenticated Obot user, any role ≥ Basic) | | User Interaction | None | | Scope | Changed (Obot authorization bypass enables access to data and operations on an upstream third-party service via Obot's stored OAuth credentials) | | Confidentiality | High | | Integrity | High (many MCP servers expose write tools — e.g. `updateEmployee`, `submitTimeoffRequest`, ticket creation, file writes) | | Availability | None | | **Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N` | | **Score** | **9.3 / Critical** | The upstream impact depends on which MCP servers are deployed and what scope their stored credentials hold; the bound is "everything the platform's stored OAuth/API credentials can reach." ## Affected Versions Confirmed on `obot v0.21.0`. ## Vulnerability Details The intended flow is that a user's authorization is checked during the OAuth process with Obot. 1. The user connects to an MCP URL through Obot. 2. During the callback, after the user logs into Obot, Obot checks that the user has access to the provided resource (the `/mcp-connect` URL in this case). Obot correctly determines the user's authorization during this flow. 3. However, another authorization check (the UI authorizer, in this case) was erroneously providing access. ## Reproduction Tested on `obot v0.21.0`. **Setup:** 1. Configure a multi-user MCP server connected to a sensitive backend — e.g. an HR system, ticketing system, or any service whose stored OAuth token grants broad read/write access. Note its ID. 4. Create an MCP Registry / Access Control Rule that grants this server **only** to a small group (e.g. two HR employees). Remove the `everyone` group from the relevant rule. 5. Create or identify a Basic User who is **not** a member of any registry granting access to this server. **Exploit:** 6. Sign in as the Basic User. 7. Verify the UI does not list the server in any connector picker (it does not — that path is correctly gated). 8. Manually craft and call the gateway URL: ``` POST https://<obot>/mcp-connect/<mcp_server_id> Authorization: <session cookie or API key> Content-Type: application/json {"jsonrpc":"2.0","id":1,"method":"tools/list"} ``` 9. Observe a successful response listing the server's tools. 10. Issue an actual tool call: ```json {"jsonrpc":"2.0","id":2,"method":"tools/call", "params":{"name":"<sensitive_tool>","arguments":{...}}} ``` 11. Observe the call succeeds, returning data scoped only by the **upstream** MCP server's OAuth credentials — not by Obot's ACRs. The exploit works equally well via Claude Desktop / Claude Code / any MCP-aware client by configuring the gateway URL as a remote MCP endpoint with the user's API key.

Source published

13 May 2026 15:32:11 UTC

Source modified

28 Sep 2026 11:55:34 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Publisher rating · CRITICAL

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot

Source published

25 Jun 2026 22:34:38 UTC

Source modified

28 Sep 2026 11:55:34 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.