CVE-2026-101063 — Obot before v0.23.0 Authentication Bypass via Registry API
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read r…
Published: 2026-09-27 · CVSS: 6.9 · CVSS 4.0
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7