CVE-2026-101063: Obot-Platform Obot

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.

Affected products

• Obot-Platform Obot: before 0.23.0 (fixed in 0.23.0)

Published 2026-09-27. Last modified 2026-09-28.