CVE-2026-105139
Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 7, 2026
- Updated
- Oct 7, 2026
- Reserved
- Oct 3, 2026
Description
Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates through the vMCP owner's shared component connection.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
obotobot-platform |
|
References
- Patch Commitpatch
- https://github.com/obot-platform/obotproduct
- GitHub Security Advisory (GHSA-xhpw-65qw-wj6m)vendor-advisory
- obot v0.26.2 Release Notesrelease-notes
- https://github.com/obot-platform/obot/blob/8cfac5d38baa4fa0719e7975b7542608ff8bc932/pkg/mcp/vmcp.go#L97technical-description
- https://github.com/obot-platform/obot/blob/8cfac5d38baa4fa0719e7975b7542608ff8bc932/pkg/mcp/vmcp.go#L231technical-description
- VulnCheck Advisory: Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resourcesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.