CVE-2026-101084 in Obot
Summary
by MITRE • 09/28/2026
obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified in obot versions prior to v0.21.1 represents a critical failure in access control mechanisms, specifically affecting the /mcp-connect endpoint. This flaw allows authenticated users who possess valid server identifiers to bypass authorization checks and establish connections to restricted Model Context Protocol servers. The core technical issue lies in the application's inability to properly validate whether an authenticated user has been explicitly granted permission to interact with a specific MCP server instance based on their assigned roles or permissions. Instead of enforcing strict access control rules that map users to authorized resources, the system relies primarily on the possession of the server ID as sufficient proof of authorization. This design oversight creates a significant security gap where any valid session token can be leveraged to initiate connections to backend systems intended for restricted use only by specific administrative or privileged accounts.
From an operational perspective, this vulnerability enables attackers who have obtained legitimate credentials through phishing, credential stuffing, or other initial access vectors to escalate their privileges and interact with sensitive backend infrastructure. By exploiting the lack of proper authorization checks on the /mcp-connect endpoint, adversaries can manipulate MCP tool calls using stored OAuth credentials associated with those restricted servers. This capability allows for unauthorized data exfiltration, modification of critical system configurations, or execution of arbitrary commands depending on the capabilities exposed by the connected MCP server tools. The impact is particularly severe because it transforms a standard authentication breach into a broader compromise of backend systems that were previously considered secure behind access control boundaries.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-862 Missing Authorization, as the application fails to enforce proper restrictions on authenticated users regarding resource-specific actions. In terms of attack taxonomy, this behavior corresponds to MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to access resources they should not be permitted to reach. The exploitation path typically involves an attacker first gaining initial authentication through compromised or stolen user credentials and then utilizing the flawed endpoint logic to pivot into restricted environments via MCP tool invocations. This lateral movement capability significantly expands the blast radius of a single credential compromise, potentially leading to full system takeover if critical backend services are accessible through these tools.
Mitigation strategies must prioritize immediate patching to version v0.21.1 or later where this access control logic has been corrected. Until patches can be applied, organizations should implement network-level controls such as firewall rules or API gateways that restrict direct access to the /mcp-connect endpoint only from trusted internal subnets if external exposure is not required. Additionally, implementing strict role-based access control validation at the application layer for all MCP server connections is essential. Security teams should also audit existing OAuth token usage and monitor for unusual patterns of tool calls originating from user accounts that do not typically interact with restricted backend systems. Regular security assessments focusing on authorization logic across API endpoints will help identify similar flaws before they can be exploited in production environments.