DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-PR6H-VR44-XQ8J: GHSA-PR6H-VR44-XQ8J: Authentication Bypass in Obot Model Context Protocol (MCP) Registry API

#security #cve #cybersecurity #ghsa

GHSA-PR6H-VR44-XQ8J: Authentication Bypass in Obot Model Context Protocol (MCP) Registry API

Vulnerability ID: GHSA-PR6H-VR44-XQ8J
CVSS Score: 5.3
Published: 2026-09-18

An authentication bypass vulnerability in Obot versions <= v0.22.1 allows unauthenticated remote attackers to access Model Context Protocol (MCP) registry metadata and retrieve server lists when OBOT_SERVER_ENABLE_REGISTRY_AUTH is configured. This is due to a routing logic flaw where /v0.1 paths are incorrectly categorized as public frontend user interface assets.

TL;DR

Obot's fallback authorization logic incorrectly treats /v0.1 API routes as public UI assets, allowing unauthenticated remote access to registered Model Context Protocol (MCP) server metadata.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862, CWE-863
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.3 (Medium)
  • Exploit Status: PoC / Active Reconnaissance
  • Impact Type: Unauthenticated Metadata Disclosure
  • Remediation: Upgrade to v0.23.0 or restrict /v0.1/ via WAF
  • CISA KEV Status: Not Listed

Affected Systems

  • Obot Platform Management Server
  • Obot: <= v0.22.1 (Fixed in: v0.23.0)

Code Analysis

Commit: 7da59f7

Reject direct access to non-UI routes except for /api/image/{id}

diff --git a/pkg/api/authz/ui.go b/pkg/api/authz/ui.go
index 93a12ec..ebd7034 100644
--- a/pkg/api/authz/ui.go
+++ b/pkg/api/authz/ui.go
@@ -32,8 +32,8 @@ var uiResources = []string{
 }

 func (a *Authorizer) checkUI(req *http.Request, user user.Info) bool {
-   // Reject direct access to /debug/, /api or /api paths for UI except for /api/image/{id}
-   if req.URL.Path == "/api" || hasAnyPrefix(req.URL.Path, "/mcp-connect/", "/oauth/", "/debug/") || (strings.HasPrefix(req.URL.Path, "/api/") && !strings.HasPrefix(req.URL.Path, "/api/image/")) {
+   // Reject direct access to non-UI routes except for /api/image/{id}.
+   if req.URL.Path == "/api" || req.URL.Path == "/v0.1" || hasAnyPrefix(req.URL.Path, "/mcp-connect/", "/oauth/", "/debug/", "/v0.1/") || (strings.HasPrefix(req.URL.Path, "/api/") && !strings.HasPrefix(req.URL.Path, "/api/image/")) {
        return false
    }
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Deploy official patch v0.23.0
  • Restrict /v0.1/ path access at the reverse proxy or WAF level
  • Disable registry routing configurations entirely if external orchestration is unneeded

Remediation Steps:

  1. Inspect the currently running Obot version to identify if it is <= v0.22.1
  2. Pull and verify the official v0.23.0 Obot release from the repository
  3. Replace existing service binaries or upgrade containerized environments to v0.23.0
  4. Execute verification tests using curls or scripts against /v0.1/servers to ensure an HTTP 401 response is returned to anonymous users

References

Read the full report for GHSA-PR6H-VR44-XQ8J on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)