CVE-2026-103758 in Obot
Summary
by MITRE • 10/01/2026
Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route. Basic-role users with a composite MCP ID can proxy requests through mcpGateway.Proxy to invoke tools on MCP servers restricted by Access Control Rules.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Obot versions 0.21.1 through 0.24.1 represents a critical authorization bypass that undermines the intended access control mechanisms of the application. This flaw specifically affects authenticated users who possess basic-role privileges, allowing them to interact with Model Context Protocol (MCP) servers in ways that should be restricted by administrative policies. The root cause lies within the checkUI deny list configuration, which fails to include the /mcp-connect-composite/ route among its blocked endpoints. This omission creates a gap in the security perimeter where authentication checks are performed but authorization enforcement is incomplete or entirely absent for this specific path.
From a technical perspective, the vulnerability exploits the mcpGateway.Proxy function to facilitate unauthorized proxying of requests. When an authenticated user with basic-role status provides a composite MCP ID, they can route their traffic through this gateway component. Because the deny list does not explicitly block access to the /mcp-connect-composite/ endpoint, the system processes these requests without applying the necessary Access Control Rules that would normally restrict such interactions. This allows the attacker to effectively bypass role-based restrictions and invoke tools hosted on MCP servers that are designated as restricted resources for lower-privileged users.
The operational impact of this vulnerability is significant, particularly in environments where sensitive data or critical functions are exposed through MCP servers. By leveraging this flaw, an adversary can execute commands or retrieve information from systems they should not have access to. This could lead to unauthorized data exfiltration, manipulation of system configurations, or further lateral movement within the network if those MCP servers provide connectivity to other internal services. The ability to proxy requests also means that attackers might use these compromised endpoints as a pivot point for additional attacks against downstream infrastructure.
This issue aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing restrictions on authenticated users. It is further categorized under MITRE ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to gain unauthorized access to resources. The specific mechanism of bypassing authorization checks via a misconfigured deny list also reflects aspects of CWE-269, Improper Privilege Management, as the user retains privileges beyond what their role should permit.
To mitigate this vulnerability, immediate action is required to update the checkUI configuration. Administrators must ensure that the /mcp-connect-composite/ route is explicitly added to the deny list for basic-role users or any other roles that should not have direct access to MCP servers via proxying mechanisms. Additionally, implementing a principle of least privilege across all gateway configurations and regularly auditing access control rules against known attack patterns can prevent similar oversights in future updates. Patching Obot to version 0.24.2 or later is essential as it addresses this specific configuration gap.