Executive brief
Obot is a platform for managing and connecting to model context protocol (MCP) servers. When registry authentication is explicitly enabled, an unauthenticated attacker can read the MCP Registry API endpoints to retrieve server metadata including names, descriptions, repository URLs, and connection URLs—information the operator intended to keep private. Attackers cannot access credential values or connect to the servers themselves, but the disclosure of the server inventory could enable further reconnaissance.
Technical details
The vulnerability is an authentication bypass in the authorization layer that checks a fixed allowlist of protected prefixes. The MCP Registry endpoints at `/v0.1/*` were not included in this allowlist, causing unauthenticated requests to bypass authentication checks and reach the registry handler. Although the registry handler itself enforces per-user access control based on anonymous identity (filtering to default or public entries only), this still exposes the server inventory metadata. The root cause matches GHSA-vw82-7fv8-r6gp, which fixed `/mcp-connect/` but overlooked the `/v0.1` registry prefix. No authentication is required; the attack vector is network-based and requires only HTTP GET access to the registry endpoint. The fix in v0.23.0 adds `/v0.1` to the protected routes requiring authentication.
Affected products
- Obot Obot <= v0.22.1
Timeline
- 2026-09-18: disclosed: GHSA-pr6h-vr44-xq8j published
- 2026-09-18: patched: Fix available in v0.23.0 or later