medium5.3
CVE-2026-101063
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled.
Impact
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.
Affected products
| Product | Affected versions |
|---|---|
| Obot | before 0.23.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.