Is CVE-2026-101062 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101062 being exploited in the wild.

How severe is CVE-2026-101062?

High severity, with a CVSS score of 8.8, published 27 September 2026.

Which products and versions are affected?

github.com/obot-platform/obot (Go) SEMVER:introduced=0,fixed=0.23.0; Obot Platform Obot <= 0.22.1.

Is there a fix for CVE-2026-101062?

Yes. github.com/obot-platform/obot (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101062 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101062?

Check whether you run github.com/obot-platform/obot (Go) or Obot Platform Obot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101062: Obot OAuth dynamic client registration authentication bypass

Q: Is there a fix for CVE-2026-101062?

Yes. github.com/obot-platform/obot (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-101062 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-101062?

Check whether you run github.com/obot-platform/obot (Go) or Obot Platform Obot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101062 · Severity: high · CVSS 8.8 · Published 2026-09-27

Obot is an AI agent platform that uses OAuth for API access control. Versions up to 0.22.1 allow an attacker to register an unauthorized OAuth client and trick a logged-in user into granting access by visiting a crafted URL, allowing the attacker to steal an access token with the victim's permissions. The attacker can then read or modify the victim's data in Obot until the token is revoked.

Technologies: github.com/obot-platform/obot (Go), Obot Platform Obot. Vendors: Go, Obot Platform.

Quick answers

Is CVE-2026-101062 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101062 being exploited in the wild.
How severe is CVE-2026-101062?: High severity, with a CVSS score of 8.8, published 27 September 2026.
Which products and versions are affected?: github.com/obot-platform/obot (Go) SEMVER:introduced=0,fixed=0.23.0; Obot Platform Obot <= 0.22.1.
Is there a fix for CVE-2026-101062?: Yes. github.com/obot-platform/obot (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101062 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101062?: Check whether you run github.com/obot-platform/obot (Go) or Obot Platform Obot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/obot-platform/obot (Go): upgrade to 0.23.0 or later
```
go get github.com/obot-platform/obot@v0.23.0
```

Technical details

The vulnerability combines three flaws: unauthenticated OAuth dynamic client registration with no redirect URI restrictions, auto-completion of the authorization flow without a consent screen, and lack of audience validation on JWT tokens. An attacker registers a client with a malicious redirect URI, crafts an authorization URL, and tricks a logged-in victim into visiting it; the issued access token carries the victim's full group set and is accepted against any API endpoint the victim can access, not just the intended MCP server. The fix in v0.23.0 adds consent screens, restricts token scope to the specific MCP server, and enforces audience validation.

Affected products

Obot Platform Obot <= 0.22.1

Identifiers

CVE-2026-101062
GO-2026-6530

Timeline

2026-06-22: disclosed: GitHub security advisory GHSA-xwmw-prc4-v3cr published
2026-09-27: advisory: CVE-2026-101062 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.