Is CVE-2026-101063 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101063 being exploited in the wild.

How severe is CVE-2026-101063?

Medium severity, with a CVSS score of 5.3, published 27 September 2026.

Which products and versions are affected?

github.com/obot-platform/obot (Go) SEMVER:introduced=0,fixed=0.23.0; Obot Platform Obot before v0.23.0.

Is there a fix for CVE-2026-101063?

Yes. github.com/obot-platform/obot (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101063 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-101063?

Check whether you run github.com/obot-platform/obot (Go) or Obot Platform Obot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101063: Obot authentication bypass in MCP Registry endpoints

CVE-2026-101063 · Severity: medium · CVSS 5.3 · Published 2026-09-27

Obot is a platform that manages AI model connections and services. When registry authentication is enabled, the system fails to properly protect its registry API endpoints, allowing unauthenticated attackers to read sensitive metadata about available servers including their names, descriptions, and connection URLs. While credentials and secret values are not exposed, this disclosure could help attackers identify and target services on the network.

Technologies: github.com/obot-platform/obot (Go), Obot Platform Obot. Vendors: Go, Obot Platform.

Quick answers

Is CVE-2026-101063 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101063 being exploited in the wild.
How severe is CVE-2026-101063?: Medium severity, with a CVSS score of 5.3, published 27 September 2026.
Which products and versions are affected?: github.com/obot-platform/obot (Go) SEMVER:introduced=0,fixed=0.23.0; Obot Platform Obot before v0.23.0.
Is there a fix for CVE-2026-101063?: Yes. github.com/obot-platform/obot (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101063 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-101063?: Check whether you run github.com/obot-platform/obot (Go) or Obot Platform Obot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/obot-platform/obot (Go): upgrade to 0.23.0 or later
```
go get github.com/obot-platform/obot@v0.23.0
```

Technical details

The vulnerability is a missing authorization check in the /v0.1/* API endpoints. The authorizer uses an allowlist of protected prefixes but /v0.1 was omitted from this list, causing unauthenticated requests to bypass the authentication challenge. The registry handler still applies ACL filtering so anonymous users only see entries they are authorized to view, but metadata exposure still occurs; fixed in v0.23.0 by adding /v0.1 to the protected route list.

Affected products

obot-platform Obot before v0.23.0

Identifiers

CVE-2026-101063
GO-2026-6525

Timeline

2026-06-22: disclosed
2026-09-27: patched: v0.23.0 released
2026-09-27: advisory: CVE-2026-101063 and GHSA-pr6h-vr44-xq8j published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.