CVE-2026-101064
published 2026-09-27CVE-2026-101064: Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary…
PriorityP345high7.6CVSS 3.1
AVNACLPRHUINSCCHILAN
EPSS
0.24%
13.9th percentile
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| obot-platform | obot | < 0.23.0 | 0.23.0 |
CVSS provenance
nvdv3.17.6HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
obot-platform Obot up to 0.22.x Remote MCP Server Registration server-side request forgery
vuldb·2026-09-27·CVSS 7.6
CVE-2026-101064 [HIGH] obot-platform Obot up to 0.22.x Remote MCP Server Registration server-side request forgery
A vulnerability categorized as problematic has been discovered in obot-platform Obot up to 0.22.x. This issue affects some unknown processing of the component Remote MCP Server Registration. The manipulation results in server-side request forgery.
This vulnerability is cataloged as CVE-2026-101064. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation.
ghsa_unreviewed·2026-09-27
CVE-2026-101064 [HIGH] CWE-918 Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation.
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-27
Published