High severity7.6NVD Advisory· Published Sep 27, 2026

CVE-2026-101064

Description

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.

Affected products

Obot Platform/obotllm-create
Range: <0.23.0

Patches

Vulnerability mechanics

References

github.com/obot-platform/obot/security/advisories/GHSA-jgh3-fggc-mcpmnvd
www.vulncheck.com/advisories/obot-before-0.23.0-server-side-request-forgery-via-mcpnvd

News mentions

No linked articles in our index yet.

cvss	0.494
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000