CRITICAL 9.3 NVD
CVE-2026-101084
obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP ser
obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.
References
- https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp
- https://www.vulncheck.com/advisories/obot-before-0.21.1-authorization-bypass-via-mcp-conne
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-27 via NVD.
Risk Timeline
CVE Disclosed2026-09-27 · -1 days ago
Remediation Resources
vulnfeed aggregates 11720 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.