Is CVE-2026-103758 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103758 being exploited in the wild.

How severe is CVE-2026-103758?

High severity, with a CVSS score of 8.1, published 1 October 2026.

Which products and versions are affected?

Obot Platform Obot 0.21.1 through 0.24.1.

Is there a fix for CVE-2026-103758?

No fixed version is recorded yet. Restrict network access to the /mcp-connect-composite/ endpoint at the reverse proxy or firewall level until patched. Additionally, restrict authenticated user base and revoke composite MCP IDs where possible. [{"kind":"disclosed","at":"2026-10-01"},{"kind":"advisory","at":"2026-09-17","note":"GitHub Security Advisory GHSA-6fwv-3h4c-37j9 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103758 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103758?

Check whether you run Obot Platform Obot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103758: Obot authorization bypass in MCP composite route

CVE-2026-103758 · Severity: high · CVSS 8.1 · Published 2026-10-01

Obot is a platform for orchestrating AI agents and integrating with external services via MCP (Model Context Protocol) servers. The vulnerability allows authenticated users to bypass access controls and reach MCP servers that administrators intended to restrict to specific groups, potentially leading to unauthorized tool execution and data access. An attacker with basic user privileges and a composite MCP ID can invoke restricted tools on protected servers.

Technologies: Obot Platform Obot. Vendors: Obot Platform.

Quick answers

Is CVE-2026-103758 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103758 being exploited in the wild.
How severe is CVE-2026-103758?: High severity, with a CVSS score of 8.1, published 1 October 2026.
Which products and versions are affected?: Obot Platform Obot 0.21.1 through 0.24.1.
Is there a fix for CVE-2026-103758?: No fixed version is recorded yet. Restrict network access to the /mcp-connect-composite/ endpoint at the reverse proxy or firewall level until patched. Additionally, restrict authenticated user base and revoke composite MCP IDs where possible.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-01"},{"kind":"advisory","at":"2026-09-17","note":"GitHub Security Advisory GHSA-6fwv-3h4c-37j9 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103758 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103758?: Check whether you run Obot Platform Obot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict network access to the /mcp-connect-composite/ endpoint at the reverse proxy or firewall level until patched. Additionally, restrict authenticated user base and revoke composite MCP IDs where possible.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-01"},{"kind":"advisory","at":"2026-09-17","note":"GitHub Security Advisory GHSA-6fwv-3h4c-37j9 published"}]

Technical details

The vulnerability is an authorization bypass due to incomplete path matching in the checkUI deny list (CWE-863). The deny list blocks /mcp-connect/ but not the sibling route /mcp-connect-composite/, allowing authenticated users to proxy requests through mcpGateway.Proxy to MCP servers. Both routes reach the same handler but the prefix check fails for the composite path, causing checkUI to default to allowing access, short-circuiting Access Control Rule enforcement.

Affected products

obot-platform Obot 0.21.1 through 0.24.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.