CVE-2026-105139GHSA-xhpw-65qw-wj6m
Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources
obot-platform obot
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.26.2obotCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates through the vMCP owner's shared component connection.
Text from CVE List
Affected versions 1
- obotaffected: 0.26.0 before 0.26.2CVE List
References 7
- github.com/obot-platform/obot/commit/8d92701c2018a7b9dd6d692498fa5f41fdb912eaFixvia CVE List
- github.com/obot-platform/obot/releases/tag/v0.26.2Fixvia CVE List
- github.com/obot-platform/obot/security/advisories/GHSA-xhpw-65qw-wj6mAdvisoryvia CVE List
- vulncheck.com/advisories/obot-0.26.0-before-0.26.2-authorization-bypass-via-vmcp-profile-prompts-and-resourcesAdvisoryvia CVE List
- github.com/obot-platform/obotReferencevia CVE List
- github.com/obot-platform/obot/blob/8cfac5d38baa4fa0719e7975b7542608ff8bc932/pkg/mcp/vmcp.go#L97Referencevia CVE List
- github.com/obot-platform/obot/blob/8cfac5d38baa4fa0719e7975b7542608ff8bc932/pkg/mcp/vmcp.go#L231Referencevia CVE List