The application performs server-side fetches to this URL during runtime initialization and automatic OAuth discovery metadata synchronization. Because the application fails to enforce egress filtering against internal subnets (RFC1918), link-local addresses, or the cloud instance metadata service (169.254.169.254), an attacker can access sensitive internal endpoints. Furthermore, since the application reflects response bodies in its error messages, this vulnerability facilitates non-blind exfiltration of data, including cloud IAM credentials, which could lead to broader account compromise. The existing 'DisallowLocalhostMCP' configuration is disabled by default and insufficient to mitigate these risks.

Impact

Successful exploitation allows an attacker with sufficient privileges to bypass network segmentation to probe internal services inaccessible from the public internet. Access to the cloud instance metadata service (169.254.169.254) can lead to the exposure of host IAM credentials, potentially resulting in full cloud account compromise. This vulnerability carries a CVSS v3.1 score of 7.6.

Recommendation

Upgrade Obot to version 0.23.0 or later immediately. The patch introduces a unified egress filtering mechanism that proactively blocks access to loopback, link-local, RFC1918, and IPv6 ULA addresses at the dial time for both the MCP client and the OAuth metadata client. Ensure that the 'DisallowLocalhostMCP' configuration, if applicable in existing environments prior to upgrading, is strictly monitored for misconfiguration.