Obot CVE-2026-101063

Exploitable ONLY when Obot is run with the config flag OBOT_SERVER_ENABLE_REGISTRY_AUTH=true (with registry auth disabled the registry is intentionally public and this is not a defect). Given that setting, no authentication, credentials, or user interaction are needed - a single GET /v0.1/servers over the network returns 200 OK. LIMITING FACTORS: the registry handler still applies per-user ACR filtering, so an anonymous caller only sees entries accessible to the anonymous identity (default-catalog/wildcard entries); only non-secret metadata (names, descriptions, repository URLs, icons, connect URLs) is exposed - no secret env/header values - and the attacker cannot connect to the servers because connecting is properly auth-protected. Affects Obot versions < v0.23.0.

This is a low-impact, high-confidence information-disclosure flaw, not a priority vulnerability. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) and the input CVSS 4.0 vector (VC:L, VI:N, VA:N = 6.9) agree on the shape: network-reachable, unauthenticated, but confidentiality-only and LOW magnitude. No EPSS score, no CISA KEV listing, and no public POC were provided. There is no SSVC data in the input. The GHSA advisory explicitly caps worst-case impact at disclosure of registry inventory metadata (server names, descriptions, repository URLs, icons, connect URLs) that the operator chose to place behind auth - critically, NO credential/secret env or header values are exposed, and anonymous callers still cannot connect to the servers because connection is properly auth-gated. The two CVSS scores diverge in headline number (5.3 vs 6.9) purely due to base-formula differences, not a signal conflict; both encode single-metric LOW confidentiality with no integrity/availability. Net: a real but minor authorization gap, easy to trigger yet with bounded consequences - patch on normal cadence, not an emergency.

An operator deploys Obot with OBOT_SERVER_ENABLE_REGISTRY_AUTH=true, expecting the MCP registry to require authentication. An unauthenticated attacker on the network sends a simple GET /v0.1/servers and receives 200 OK with catalog metadata (server names, descriptions, repository and connect URLs) for entries visible to the anonymous identity. No public exploit code was identified at time of analysis; exploitation requires only a single unauthenticated HTTP request (AC:L, PR:N, no UI).