Obot server-side request forgery via remote MCP server URL

Severity: high · CVSS 7.6 · Published 2026-09-18

Obot is a platform for building conversational AI agents. A flaw allows privileged users (Power User role or higher) to register remote MCP servers with URLs pointing to internal services or cloud metadata endpoints. When these servers are launched or their status is checked, Obot fetches the URL server-side without validation, enabling attackers to read responses from internal systems or retrieve cloud IAM credentials that could lead to account compromise.

Technologies: github.com/obot-platform/obot (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.6, published 18 September 2026.
Which products and versions are affected?
github.com/obot-platform/obot (Go) < 0.23.0.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run github.com/obot-platform/obot (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a server-side request forgery (SSRF) vulnerability in Obot's remote MCP (Model Context Protocol) server registration. The vulnerability exists because the RemoteRuntimeConfig.URL is validated only for being parseable and using http/https scheme, with no destination IP validation. The vulnerable code paths include server launch and OAuth state checks, with automatic metadata-fetching during reconciliation. The issue is non-blind SSRF since error messages reflect the fetched response body. Attackers with Power User, Power User Plus, or Admin role can reach loopback, link-local addresses (169.254.169.254), RFC1918 private ranges, and IPv6 ULA addresses. The guard DisallowLocalhostMCP is disabled by default and absent from the metadata-fetch path. Fixed in v0.23.0 by implementing uniform egress filtering that rejects restricted IP ranges at dial time.

Affected products

  • Obot Obot <= 0.22.1

Timeline

  • 2026-09-18: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.