CVE-2026-105138GHSA-q5wf-87f5-cxgq
Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
obot-platform obot
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.26.2obotCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.
Text from CVE List
Affected versions 1
- obotaffected: 0.12.0 before 0.26.2CVE List
References 7
- github.com/obot-platform/obot/commit/644a1fd60a66125ced3de10b350a983e933def7aFixvia CVE List
- github.com/obot-platform/obot/releases/tag/v0.26.2Fixvia CVE List
- github.com/obot-platform/obot/security/advisories/GHSA-q5wf-87f5-cxgqAdvisoryvia CVE List
- vulncheck.com/advisories/obot-0.12.0-before-0.26.2-credential-exposure-via-mcp-catalog-entry-apiAdvisoryvia CVE List
- github.com/obot-platform/obotReferencevia CVE List
- github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/authz/resources.go#L27Referencevia CVE List
- github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/handlers/mcp.go#L206-L212Referencevia CVE List