Obot /mcp-connect Endpoint Ignores Access Control Rules

Obot before v0.21.1 fails to enforce access control rules on /mcp-connect, letting any authenticated user connect to restricted MCP servers by supplying the server ID.

cat cve-2026-101084.json

Vendor: Obot Platform
Product: Obot (before v0.21.1)
CVSS: 9.6
EPSS (exploit probability): N/A
Status: patched
Published: September 28, 2026
Source: https://github.com/obot-platform/obot/security/advisories/GHSA-vw82-7fv8-r6gp

Obot’s control plane records per-user MCP server access rules, but those rules were not applied to the /mcp-connect endpoint in versions before v0.21.1. Any authenticated user who obtained a restricted server’s ID could bypass access controls and connect directly.

Fixed in Obot v0.21.1. Disclosed via GitHub Security Advisory GHSA-vw82-7fv8-r6gp.

Related coverage

~/articles/2026-09-28-obot-three-cves-mcp-docker-access-control

mcp

Obot AI Platform Patches Three CVEs, Two Critical

Three GitHub Security Advisories disclose an unauthenticated Docker exposure and two MCP endpoint access control failures in the Obot AI agent platform.

Sep 28read →