Act nowDisclosed

Advisory · CVE-2026-101084

Obot /mcp-connect skipped authorization checks, opening restricted MCP servers

Obot before 0.21.1 did not enforce Access Control Rules on the /mcp-connect endpoint, letting any authenticated user reach restricted MCP servers and their stored OAuth credentials.

Advisory published September 27, 2026Independent summary
Vendor
obot-platform
Product
Obot
Identifier / CWE
CVE-2026-101084
CWE-639
Action timing
Immediate
ELI5

Explain it like I’m five

Obot had a VIP room guarded by a bouncer, except one side door where the bouncer never stood. Any logged-in visitor who knew the room's number could walk in and use the stored keys to reach the connected back-end systems.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Restricted MCP servers

    Administrators mark some MCP servers as restricted, protected by Access Control Rules.

  2. 02Unenforced endpoint

    The /mcp-connect endpoint in Obot before 0.21.1 did not enforce those rules.

  3. 03Direct connect

    Any authenticated user who possessed a restricted server's ID could connect to it, bypassing the authorization checks.

  4. 04Backend reach

    Through MCP tool calls using the server's stored OAuth credentials, the attacker could access and manipulate sensitive backend systems.

What happened

Obot versions before 0.21.1 failed to enforce Access Control Rules on the /mcp-connect endpoint. Any authenticated user who possessed the ID of a restricted MCP server could connect to it, bypassing the authorization checks that were supposed to keep those servers off limits. Through MCP tool calls using the server’s stored OAuth credentials, the attacker could then access and manipulate sensitive backend systems.

The flaw is fixed in Obot 0.21.1, which enforces the access control rules on the endpoint.

What to do

  1. Inventory Obot deployments and upgrade to 0.21.1 or later.
  2. Review access and connection logs for /mcp-connect calls from users outside the permitted groups, especially against restricted server IDs.
  3. Determine which restricted MCP servers were reachable and which backend systems their OAuth credentials touch.
  4. Rotate the stored OAuth credentials and any secrets those backend systems expose if unauthorized connections cannot be ruled out.

Management note

Authorization that works everywhere except one endpoint is authorization theater. This one is worth an audit rather than just a patch, because any low-privilege user with a server ID had the keys; the exposure window matters more than the version number.