Obot /mcp-connect Endpoint Ignores Access Control Rules
Obot before v0.21.1 fails to enforce access control rules on /mcp-connect, letting any authenticated user connect to restricted MCP servers by supplying the server ID.
- Vendor
- Obot Platform
- Product
- Obot (before v0.21.1)
- CVSS
- 9.6
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
Is CVE-2026-101084 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-101084 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-101084 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Obot’s control plane records per-user MCP server access rules, but affected releases did not apply those rules to the /mcp-connect/{id} gateway endpoint. Any authenticated Obot user who obtained a restricted MCP server ID could bypass the intended authorization check and connect to that server even without membership in its registry access groups.
The bypass could expose the tools and backend systems available through the targeted MCP server. The vendor advisory also warns that the connection may use OAuth credentials already stored for that integration, increasing the impact beyond simple registry discovery. Authentication to Obot is still required; this is an authorization failure between logged-in users and restricted servers.
Upgrade to Obot v0.21.1 or later, where the gateway enforces the configured access-control rules before allowing a connection. The issue was disclosed as GitHub Security Advisory GHSA-vw82-7fv8-r6gp.
Other Obot Platform CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-101065 Obot Docker Quickstart Exposes API on All Interfaces Without Authwrite-up | [ CRITICAL ] | 9.8 | 0.4% | — |
| CVE-2026-101063 Obot MCP Registry Endpoints Unauthenticated When Auth Is Enabledwrite-up | [ MEDIUM ] | 5.3 | 0.2% | — |
