CVE-2026-101084

9.6 CRITICALpublic exploit available

Published 2026-09-27 · Updated 2026-09-28

AI risk analysis

Summary: The flaw allows any authenticated user to connect to restricted MCP servers by possessing the server ID, bypassing authorization checks and accessing sensitive backend systems.
Exploitability: Exploitation is relatively easy given the possession of the server ID and authenticated user status. Precondition is the presence of stored OAuth credentials.
Blast radius: If exploited, attackers can access and manipulate sensitive backend systems, leading to potential data breaches or system compromise.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version v0.21.1 or later.

auth-bypasswebmcpbackend

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weaknesses

CWE-639

Public exploit & PoC references

https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.