Executive brief
Obot: MCP Registry API readable without authentication
Affected products
- Go github.com/obot-platform/obot
Junglewise Threat Intelligence
Obot: MCP Registry API readable without authentication
Severity: low · CVSS 3.1 · Published 2026-09-18
Technologies: github.com/obot-platform/obot (Go). Vendors: Go.
Related threats
- Obot server-side request forgery via remote MCP server URL
- Obot: Server-Side Request Forgery via remote MCP server URL
- Obot MCP Registry API authentication bypass
- Obot OAuth dynamic client registration token theft via audience confusion
- Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion