Executive brief
Obot is a platform for building conversational AI agents. A flaw allows privileged users (Power User role or higher) to register remote MCP servers with URLs pointing to internal services or cloud metadata endpoints. When these servers are launched or their status is checked, Obot fetches the URL server-side without validation, enabling attackers to read responses from internal systems or retrieve cloud IAM credentials that could lead to account compromise.
Technical details
This is a server-side request forgery (SSRF) vulnerability in Obot's remote MCP (Model Context Protocol) server registration. The vulnerability exists because the RemoteRuntimeConfig.URL is validated only for being parseable and using http/https scheme, with no destination IP validation. The vulnerable code paths include server launch and OAuth state checks, with automatic metadata-fetching during reconciliation. The issue is non-blind SSRF since error messages reflect the fetched response body. Attackers with Power User, Power User Plus, or Admin role can reach loopback, link-local addresses (169.254.169.254), RFC1918 private ranges, and IPv6 ULA addresses. The guard DisallowLocalhostMCP is disabled by default and absent from the metadata-fetch path. Fixed in v0.23.0 by implementing uniform egress filtering that rejects restricted IP ranges at dial time.
Affected products
- Obot Obot <= 0.22.1
Timeline
- 2026-09-18: disclosed