Executive brief
Obot: Server-Side Request Forgery via remote MCP server URL
Affected products
- Go github.com/obot-platform/obot
Junglewise Threat Intelligence
Obot: Server-Side Request Forgery via remote MCP server URL
Severity: low · CVSS 3.1 · Published 2026-09-18
Technologies: github.com/obot-platform/obot (Go). Vendors: Go.
Related threats
- Obot server-side request forgery via remote MCP server URL
- Obot MCP Registry API authentication bypass
- Obot: MCP Registry API readable without authentication
- Obot OAuth dynamic client registration token theft via audience confusion
- Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion