What is the CVSS score of CVE-2026-101084?

CVE-2026-101084 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-101084?

Within 24 hours, inventory every Obot instance and confirm which run versions before v0.21.1, then identify which of those register credential-bearing MCP servers or rely on Access Control Rules for data isolation; simultaneously pull gateway logs for /mcp-connect/{id} requests and compare callers against the intended server scopes to determine whether any user outside the authorized group already exercised this path, and if you cannot patch immediately, block or disable external access to the gateway endpoint and pause non-essential credential-bearing servers. Within 7 days, upgrade all affected instances to the vendor-released fixed version 0.21.1 (or later), rotate every OAuth token, API key, and stored credential used by the upstream MCP servers, re-scope those credentials to least privilege so the gateway no longer carries broader rights than the servers require, and invalidate active user sessions so pre-upgrade tokens cannot be reused. Within 30 days, audit all Access Control Rules and MCP Registry membership for correct enforcement on the gateway path, add monitoring and alerting for unauthorized or anomalous /mcp-connect calls, fold authorization testing of gateway endpoints into change management and pre-release checks, and complete a data-exposure review of the backends reachable by the affected credentials to determine whether any notification or remediation obligations are triggered.

Obot CVE-2026-101084

Q: Which versions of Obot are affected by CVE-2026-101084?

A critical authorization bypass in Obot (fixed in v0.21.1) lets any user holding a Basic role or higher reach MCP servers that administrators deliberately restricted, because the /mcp-connect/{id}…. A patch is available.

EUVD-2026-88029 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-27 VulnCheck

GHSA-g524-9c6h-8w7v

Authentication Bypass Go Obot

9.3

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privilege Obot user
Delivery

Obtain restricted MCP server ID
Exploit

Call /mcp-connect/{id}, ACR check bypassed
Execution

Invoke MCP tools via stored OAuth creds
Impact

Read/modify sensitive third-party backend

Vulnerability Assessment

Weakness	CWE CWE-639 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Object-level authorization, IDOR prevention
Exploitation Conditions	Requires a valid authenticated Obot account of any role at or above Basic (PR:L) and knowledge of a target MCP Server ID; the /mcp-connect/{id} gateway endpoint then fails to evaluate Access Control Rules / MCP Registry membership. Exploitation is limited to deployments that (a) run multiple users/tenants, (b) register MCP servers connected to sensitive backends via stored OAuth/API credentials, and (c) rely on ACRs to restrict those servers to specific groups. The realized impact is bounded by the scope of the stored upstream credentials. Single-group or single-tenant installations, and versions v0.21.1+, are not affected.
Impact	This is a genuine high-priority authorization flaw, not a CVSS-inflated non-issue. The vendor/reporter CVSS 4.0 (9.3) and mirrored 3.1 (9.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) are internally consistent and defensible: network vector, low complexity, and only a low-privilege authenticated Obot account (any role ≥ Basic) are needed, with no user interaction. The Scope:Changed / high VC+VI is justified because the bypass pivots through Obot's stored upstream OAuth/API credentials to reach and manipulate third-party backends (HR, ticketing, file writes) - impact is bounded by 'everything the platform's stored credentials can reach.' Tempering signals: no EPSS score, no CISA KEV listing, and no public exploit are provided, so this is 'no public exploit identified at time of analysis' - the 9.3 reflects potential impact and ease, not observed exploitation. The one real exploitation gate is knowledge of a valid MCP Server ID, which the reporter treats as low-friction (IDs are enumerable/discoverable to insiders) but which is still a prerequisite. Net: real priority for any multi-tenant Obot deployment relying on Access Control Rules to segregate sensitive MCP servers; less urgent for single-tenant/single-group installs.
Exploit ScenarioDerived	An organization runs Obot with an MCP server wired to a sensitive backend (e.g. an HR system) restricted via an Access Control Rule to two HR employees. A low-privilege 'Basic' user who is not in that group obtains the MCP server's ID and sends it to the /mcp-connect/{id} gateway endpoint, which fails to enforce the ACR and grants a session. The attacker then issues MCP tool calls (e.g. read employee records, submitTimeoffRequest, updateEmployee) executed with the platform's stored OAuth credentials. No public PoC is provided, but the advisory includes step-by-step reproduction on v0.21.0.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 27, 2026

Authorization bypass in Obot before v0.21.1 lets any authenticated user with a known MCP Server ID connect to restricted MCP servers through the /mcp-connect/{id} gateway endpoint, which fails to enforce Access Control Rules and MCP Registry membership. Because the gateway reuses Obot's stored OAuth/API credentials for the upstream server, an attacker in a Basic role or above can invoke that server's tools - reading and writing data in whatever backends those credentials reach - even when administrators explicitly scoped the server to a small group. Independently assessed at CVSS 9.3, this is a genuine high-priority authorization flaw limited to multi-user deployments that register credential-bearing MCP servers and depend on ACRs for isolation; no public exploit code has been identified at time of analysis, and vendor-released patched version 0.21.1 is available.

RemediationAI

Upgrade Obot to v0.21.1 or later, the vendor-released fix that closes the authorization bypass on /mcp-connect/{id}; see GHSA-vw82-7fv8-r6gp and the VulnCheck advisory for the authoritative reference. Until upgrading, reduce exposure by treating every registered MCP server ID as publicly known: audit stored OAuth/API credentials and re-scope them to least privilege (read-only or narrow resource sets) so a bypass yields limited data - the trade-off is that legitimate automated and user-driven tool calls may need re-consent or updated scopes. Additionally, avoid registering MCP servers whose credentials grant broad read/write access to sensitive backends on multi-user instances, and consider suspending or deregistering high-risk servers until the patch is applied, at the cost of losing those integrations. Network-level controls (restricting the Obot gateway to trusted networks or single-user deployments) can reduce the attack surface but do not replace the upgrade, since any holder of a valid Basic-or-higher account on a reachable instance can still exploit the missing ACR check; there is no vendor-provided configuration flag documented to re-enable authorization enforcement on this endpoint.

Affected VersionsENISA

obot 0 <0.21.1

Affected Packages

go github.com/obot-platform/obot fix: 0.21.1

euvd obot fix: 0.21.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Obot is an open-source platform that acts as an MCP (Model Context Protocol) gateway, brokering connections between users and registered MCP servers that front sensitive backends (HR systems, ticketing platforms, file stores) using stored OAuth/API credentials. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the gateway route /mcp-connect/{mcp_id} performs no Access Control Rule (ACR) evaluation, so the client-supplied MCP Server ID effectively becomes an authorization key. Per the reporter, the platform does correctly check authorization during the OAuth callback, but a second check via the UI authorizer erroneously granted access, leaving the gateway path unprotected. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N reflects network reachability, low complexity, a low-privileged authenticated actor, scope change (the bypass extends into upstream third-party services reached by Obot's stored credentials), and both high confidentiality and integrity impact from write-capable MCP tools; availability is unaffected. The realized blast radius is bounded by the privileges of the stored upstream credentials - essentially everything those tokens can read or write.

Know when Obot gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

vuln.today AI 9.6 CRITICAL

Network endpoint reachable by any low-privilege authenticated user (PR:L, AC:L, UI:N); bypass pivots through stored OAuth creds to a separate upstream system (S:C) enabling read and write (C:H/I:H), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

None

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Sep 27, 2026 - 22:01 EUVD

CVE Published

Sep 27, 2026 - 20:49 cve.org

CRITICAL 9.3

DescriptionCVE.org

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

Technical POC Analysis

Authorization bypass through a user-controlled object key, consistent with CWE-639.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

A critical authorization bypass in Obot (fixed in v0.21.1) lets any user holding a Basic role or higher reach MCP servers that administrators deliberately restricted, because the /mcp-connect/{id} gateway endpoint reuses Obot's own stored upstream credentials instead of the requesting user's entitlements. The practical effect is that Access Control Rules and MCP Registry scoping no longer isolate data: any connected backend those credentials can reach - including write access - becomes reachable by staff who were never intended to touch it. Leadership should care because this affects multi-user deployments that register credential-bearing MCP servers, meaning the blast radius is measured by the privileges of the stored credentials, not by the size of the group the server was scoped to.

Business Impact: High

Compensating Controls

Apply vendor patch (upgrade to 0.21.1 or later). Until patching is complete, restrict network reachability of the /mcp-connect/{id} gateway endpoint to trusted administrators or internal ranges, disable or de-register non-essential credential-bearing MCP servers, and reduce the privileges of stored upstream OAuth/API credentials so a bypass yields the least possible access.

Threat Intelligence Overview

EPSS Score

0.3%

Top 82% exploitable

Prevalence

Low

niche emerging open-source AI-agent/MCP gateway platform, limited production footprint

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.