obot-platform obot
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114662 | < 0.26.0 | Obot before 0.26.0 API Key Theft via CLI Login Token Request | HIGH 8.6 | 0.2 % | ||
| CVE-2026-105140 | 0.25.0 – < 0.25.6 ; 0.26.0 – < 0.26.1 | Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership | LOW 2.3 | 0.2 % | ||
| CVE-2026-105139 | 0.26.0 – < 0.26.2 | Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-105138 | 0.12.0 – < 0.26.2 | Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API | HIGH 7.1 | 0.3 % | ||
| CVE-2026-103758 | 0.21.1 – 0.24.1 | Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route | HIGH 8.6 | 0.2 % | ||
| CVE-2026-101084 | < 0.21.1 | obot before v0.21.1 Authorization Bypass via /mcp-connect | CRITICAL 9.3 | 0.3 % | ||
| CVE-2026-101065 | ≤ * | Obot Quickstart Docker Deployment Unauthenticated Admin Access | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-101064 | < 0.23.0 | Obot before v0.23.0 Server-Side Request Forgery via MCP | HIGH 8.3 | 0.2 % | ||
| CVE-2026-101063 | < 0.23.0 | Obot before v0.23.0 Authentication Bypass via Registry API | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-101062 | < 0.23.0 | Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration | HIGH 8.7 | 0.3 % |