{"id":"CVE-2026-101084","published":"2026-09-27T21:17:02.163","lastModified":"2026-09-28T20:55:27.360","description":"obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp","tags":[]},{"url":"https://www.vulncheck.com/advisories/obot-before-0.21.1-authorization-bypass-via-mcp-connect","tags":[]}],"exploitRefs":[{"url":"https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows any authenticated user to connect to restricted MCP servers by possessing the server ID, bypassing authorization checks and accessing sensitive backend systems.","exploitability":"Exploitation is relatively easy given the possession of the server ID and authenticated user status. Precondition is the presence of stored OAuth credentials.","blast_radius":"If exploited, attackers can access and manipulate sensitive backend systems, leading to potential data breaches or system compromise.","remediation":"Upgrade to version v0.21.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","mcp","backend"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T08:49:11.591Z"}}