Obot CVE-2026-105138

Exploitation requires an authenticated Obot account at 'basic' privilege (CVSS PR:L) that has been explicitly granted the target MCP catalog entry through Obot's access-control rules, AND the catalog entry must have static secret values (API keys/tokens) set on it by an admin or power user. Given those conditions, the attacker simply calls GET /api/all-mcps/entries/{entry_id} and the static configuration is returned in plaintext. Limiting factors that reduce real-world risk: valid authentication is mandatory (no anonymous access), the attacker must have been granted the specific entry, and only entries that actually carry admin-set static secrets are exploitable - entries using user-supplied config or Kubernetes secret bindings are not affected. The fix is deployed by upgrading to Obot v0.26.2 or later.

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and is internally consistent with the description: network-reachable, low complexity, requiring low privileges (PR:L = an authenticated 'basic' user), no user interaction, with high confidentiality impact and no integrity or availability impact. That maps cleanly to a read-only credential-disclosure flaw (CWE-522). No EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit code was referenced, so exploitation status is: no public exploit identified at time of analysis. The practical risk is bounded by a real precondition - the attacker must already be an authenticated user who has been granted a specific MCP catalog entry via access-control rules, and that entry must contain static secrets configured by an admin or power user - so this is privilege-escalation-of-data by an insider or a compromised low-privilege account rather than remote unauthenticated takeover. The secondary impact is notable: leaked API keys/tokens can be abused against external backend services, extending blast radius beyond Obot itself, which is why the confidentiality rating is appropriately High. A patch is confirmed available (release v0.26.2; commit 644a1fd), and VulnCheck is the reporting source with a dedicated advisory, raising confidence in the finding's validity.

A legitimate low-privilege ('basic') Obot user who has been granted access to an MCP catalog entry issues a GET /api/all-mcps/entries/{entry_id} request and receives the entry manifest with static configuration values returned in plaintext, including API keys or tokens that an admin embedded. The user then replays those credentials directly against the upstream backend services they authenticate to. No public exploit code was identified, but the attack requires only a routine authenticated API call and no special tooling.