Obot Before 0.23.0 Server Side Request Forgery Via Mcp

Back www.vulncheck.com

Obot Before 0.23.0 Server Side Request Forgery Via Mcp

www.vulncheck.com • September 28, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Obot Before 0.23.0 Expose Authentication and SSRF Risks Two critical vulnerabilities have been identified in Obot versions prior to 0.23.0. The first is an authentication bypass via OAuth dynamic client registration, which allows unauthorized access to sensitive resources. The second vulnerability is a server-side request forgery (SSRF) flaw via MCP, which could enable attackers to send unauthorized requests from the server. Both vulnerabilities affect all versions of Obot before 0.23.0, potentially impacting a wide range of users. No specific exploitation in the wild has been reported yet, but the vulnerabilities are serious enough to warrant immediate attention. Organizations using affected versions are advised to prioritize patching to mitigate risks. The vulnerabilities have been disclosed by VulnCheck, with no CVEs assigned yet. The current status is that both vulnerabilities are disclosed but not actively exploited. 57

Extracted Entities

Attack Types (1)

Server-Side Request Forgery