Advisories · Technology
obot.
Every CVE that names obot among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
Obot before 0.26.0 API Key Theft via CLI Login Token Request
- obot
- Cross-site request forgery (CSRF)
- CVSS 2.3 Low
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership
- obot
- Race condition
- CVSS 5.3 Medium
Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources
- obot
- Broken access control
- CVSS 7.1 High
Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
- obot
- Hard-coded credentials
- CVSS 8.6 High
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route
- obot
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Obot Quickstart Docker Deployment Unauthenticated Admin Access
- obot
- Authentication bypass