Executive brief
Obot, a platform for managing AI-driven tools and services, contains a security flaw that allows any logged-in user to access restricted internal tools. Even if an administrator has limited a specific tool (like an HR or ticketing system) to a small group, any other user with a basic account can bypass these restrictions. This could lead to unauthorized viewing of sensitive data or the execution of administrative actions across connected corporate systems.
Technical details
An authorization bypass exists in the Obot MCP gateway endpoint `/mcp-connect/{mcp_id}`. While the UI correctly filters available servers based on Access Control Rules (ACRs), the backend endpoint fails to enforce these rules for direct API requests. An authenticated user with a valid session or API key can interact with any MCP server by manually crafting a POST request to the gateway URL if they know the target server's ID. This allows the attacker to list tools and execute tool calls using the platform's stored OAuth or API credentials, potentially gaining full access to upstream third-party services. The vulnerability is addressed in version 0.21.1.
Affected products
- Obot Platform Obot <= 0.21.0
Timeline
- 2026-05-07: patched: Version 0.21.1 released
- 2026-05-13: disclosed: GitHub Advisory published