Obot CVE-2026-103758

Requires an authenticated Obot account at the low-privileged 'Basic-role' level plus possession of a composite MCP ID; the attacker then targets MCP servers that are supposed to be restricted by Access Control Rules. Exploitation is only possible on Obot versions 0.21.1 through 0.24.1 where the checkUI deny list omits the /mcp-connect-composite/ route, and only yields unauthorized access where ACL-restricted MCP servers/tools actually exist to reach. No user interaction is needed (UI:N) and no admin privileges are required, but a valid authenticated session and the composite MCP ID are hard prerequisites that limit purely anonymous exploitation.

This is a genuine, high-priority authorization flaw for Obot operators, though its real-world blast radius is bounded by the product's niche footprint. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 and is internally consistent with the description: network-reachable, low attack complexity, no user interaction, requiring only a low-privileged ('Basic-role') authenticated account, with high confidentiality and integrity impact and no availability impact. The CWE-863 (Improper Authorization) classification matches the root cause - a missing deny-list entry - far better than the 'Authentication Bypass' tag, which overstates it since the attacker is already authenticated. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the severity rests on impact and ease of abuse rather than any observed weaponization. The one notable caveat is prevalence: an 8.6 on a small-deployment AI-agent platform is a high-severity-but-low-footprint issue, so it should be prioritized urgently by the organizations that actually run Obot 0.21.1-0.24.1, not treated as an internet-wide emergency.

A low-privileged Basic-role user who has obtained a composite MCP ID crafts HTTP requests to the /mcp-connect-composite/ endpoint, which the checkUI deny list fails to block. Those requests are proxied through mcpGateway.Proxy to invoke tools on MCP servers the user was explicitly denied by Access Control Rules, letting them read and act through restricted backend capabilities. No public proof-of-concept was referenced, but exploitation is straightforward given the low complexity and requires only a valid low-privilege account.