Obot CVE-2026-105139

Requires an authenticated Obot user whose identity matches at least one configured vMCP (virtual MCP) profile selector (PR:L), and the deployment must expose a vMCP with a shared component connection whose profiles grant tool access but not the targeted prompts/resources. The flaw is triggered by requesting prompts, resources, or resource templates (not tools) of components not granted to the user, because pre-0.26.2 profile enforcement was applied only to tools. Limiting factors: exploitation is impossible without valid authentication and a vMCP configuration that segments component access via profiles; single-user or fully-trusting deployments where all users are meant to access all components see no practical impact. Affects Obot 0.26.0 up to (not including) 0.26.2.

This is a moderate-severity authorization bypass (CWE-863) rated CVSS 5.3, confirmed by the provided CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N: network-reachable (AV:N), low attack complexity (AC:L), no special attack requirements (AT:N), but requiring low-level authentication (PR:L) and no user interaction (UI:N). Impact is limited to low confidentiality (VC:L) with no integrity or availability impact (VI:N/VA:N) and no scope change to subsequent systems (SC:N/SI:N/SA:N), consistent with an information-disclosure/over-reach flaw rather than code execution. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit was referenced - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a low-privilege authenticated user can read prompts, resources, and resource templates of components they were not granted, but cannot modify or destroy them. This is a genuine but bounded issue: real priority is elevated for multi-tenant Obot deployments where vMCP profiles are used to segment component access, and lower for single-user or trusted-tenant deployments. The source-code evidence (the patch adds profile-based component filtering to the OAuth consent/auth path and a regression test confirming disabled components are not probed) corroborates the description. Missing signals: EPSS probability and any POC are absent, so widespread automated exploitation cannot be assessed from the data.

An authenticated Obot user whose identity matches any vMCP profile selector connects to a virtual MCP (vMCP) and, instead of only invoking the tools their profile grants, requests prompts, resources, or resource templates belonging to components they were never authorized for. Because authorization was enforced only on tools, the request is served through the vMCP owner's shared component connection, exposing data from ungranted components. No public exploit code was referenced, and exploitation requires a valid authenticated session (PR:L).