Skip to content
Threat Feed
Subscribe

Vendor

Obot

3 briefs RSS
high advisory

Obot: Authentication bypass in CLI login flow (CVE-2026-114662)

Obot versions prior to 0.26.0 contain an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to harvest API keys by manipulating token requests.

Obot authentication-bypass api-security web-application-vulnerability
1r 1t 1c
critical advisory

Obot Docker Quickstart Authentication Misconfiguration

Obot versions up to commit d7e6970 contain a default configuration vulnerability that exposes the application with administrative privileges and Docker socket access to unauthenticated network actors.

Obot +4 authorization-bypass cve mcp authentication-bypass oauth cve-2026-101062 cloud privilege-escalation +1
5t 1c updated
high advisory

SSRF Vulnerability in Obot via Remote MCP Server URLs

Obot versions 0.22.1 and earlier are vulnerable to server-side request forgery (SSRF) allowing authenticated privileged users to probe internal network resources and cloud instance metadata services.

Obot +1 ssrf cloud-security vulnerability oauth authentication-bypass token-theft mcp
5t