CVE-2026-105138highCWE-522

CVE-2026-105138: falha de alta gravidade em obot-platform obot

Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Publicada em

18Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
obot-platform · obot
CVEs relacionadas — obot-platform obot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-101065CRITICALObot Quickstart Docker Deployment Unauthenticated Admin AccessEPSS 0.4%CVE-2026-101062HIGHObot before v0.23.0 Authentication Bypass via OAuth Dynamic Client RegistrationEPSS 0.3%CVE-2026-101084CRITICALobot before v0.21.1 Authorization Bypass via /mcp-connectEPSS 0.3%CVE-2026-101063MEDIUMObot before v0.23.0 Authentication Bypass via Registry APIEPSS 0.2%CVE-2026-101064HIGHObot before v0.23.0 Server-Side Request Forgery via MCPEPSS 0.2%CVE-2026-103758HIGHObot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ RouteEPSS 0.2%
Referências
https://github.com/obot-platform/obothttps://github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/authz/resources.go#L27https://github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/handlers/mcp.go#L206-L212https://github.com/obot-platform/obot/commit/644a1fd60a66125ced3de10b350a983e933def7ahttps://github.com/obot-platform/obot/releases/tag/v0.26.2https://github.com/obot-platform/obot/security/advisories/GHSA-q5wf-87f5-cxgqhttps://www.vulncheck.com/advisories/obot-0.12.0-before-0.26.2-credential-exposure-via-mcp-catalog-entry-api