CVE-2026-101064
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server…
- Risk score
- 48/100
- CVSS
- 7.6 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints,…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.23.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.6 high
References
Original description
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.
Last activity 27 Sep 2026. Patch Forecast updates every hour.