CVE-2026-101064

HIGH 7.6

Obot before v0.23.0 Server-Side Request Forgery via MCP

CVSS Score

7.6

EPSS Score

0.0%

EPSS Percentile

0th

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.

CWE	CWE-918
Vendor	obot-platform
Product	obot
Published	Sep 27, 2026

Stay Ahead of the Next One

Get instant alerts for obot-platform obot

Be the first to know when new high vulnerabilities affecting obot-platform obot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

obot-platform / obot

0 < 0.23.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/obot-platform/obot/security/advisories/GHSA-jgh3-fggc-mcpm vulncheck.com: https://www.vulncheck.com/advisories/obot-before-0.23.0-server-side-request-forgery-via-mcp

Credits

🔍 hewei-gikaku