Obot: Authorization bypass in MCP gateway via composite route
Summary
Obot versions 0.21.1 through 0.24.1 contain an authorization bypass in the MCP gateway. The UI fallback deny list covers /mcp-connect/ but not /mcp-connect-composite/, so requests to the composite route reach the same proxy handler without the checks applied to the guarded route. An authenticated user with a composite MCP ID, including a low-privilege Basic role user, can invoke tools on MCP servers that the administrator restricted with Access Control Rules.
Affected
- Obot 0.21.1 through 0.24.1 (obot-platform/obot, Go package github.com/obot-platform/obot)
- Default configuration: unaffected according to the CVE record, as the vulnerable code path applies to affected versions only.
- Unknown: whether 0.25.x releases are affected.
Fixed in
- Fixed in v0.26.0 according to the release notes, which list GHSA-6fwv-3h4c-37j9 under Security. Not confirmed against the GHSA advisory itself.
- The OSV record lists 0.24.1 as fixed, but this is also the last affected version and appears to be a data error.
Workaround
- No vendor-documented workaround found. Upgrading to the fixed release is the remedy.
- Interim steps (not vendor-sourced): review which accounts hold the lowest role and which MCP servers they can reach, and restrict access where the business allows.
Exploitation
- No evidence of exploitation in the wild found. The CISA KEV catalogue was not checked directly.
- No public proof of concept found.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- EPSS 0.00221 (predicted likelihood, not evidence of exploitation).
Our recommendation
- Check whether Obot is in use. If not, no action is needed beyond confirming that.
- If Obot is in use with multiple user accounts, prioritise the upgrade to v0.26.0 or later. Plan for the change from composite MCP servers to virtual MCPs in that release.
- Review accounts with the lowest role and their MCP server access, and check Obot logs for unexpected MCP access.
- Check whether Obot is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6fwv-3h4c-37j9 github.com
- VulnCheck advisory www.vulncheck.com
- Obot release v0.26.0 github.com
- Obot release v0.24.1 github.com
- OSV record CVE-2026-103758 osv.dev
- Strix CVE record CVE-2026-103758 www.strix.ai
- Vulners MEND record CVE-2026-103758 vulners.com
- OpenCVE CVE-2026-103758 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:31.
Original description (NVD)
Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route. Basic-role users with a composite MCP ID can proxy requests through mcpGateway.Proxy to invoke tools on MCP servers restricted by Access Control Rules.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.