CVE-2026-101084: Obot let any user connect to restricted…

CVE-2026-101084: Obot let any user connect to restricted MCP servers by ID

In Obot, the open-source MCP platform, the /mcp-connect/{id} gateway didn't enforce access control rules before v0.21.1. Any logged-in user who knew a server's ID could use that MCP server's tools with its stored OAuth credentials. A second advisory warns that the old Docker quickstart ran with authentication off.

01.

What it is

Obot checked a user's access during the OAuth flow, but another authorizer wrongly allowed the request, so a Basic user outside the allowed group could still connect through /mcp-connect/{mcp_id} and make tool calls. The impact is whatever the stored OAuth or API credentials can reach.

CVE-2026-101065 (GHSA-jj4w-pfgv-4mrm): the README's Docker quickstart started Obot on 0.0.0.0:8080 with authentication disabled, which maps every request to a user with Owner and Admin roles. Because the quickstart also mounted /var/run/docker.sock, anyone who reached the port could launch MCP servers with access to the host's Docker. The fix was to the documentation only.

02.

How to check

Affected: github.com/obot-platform/obot 0.21.0 and earlier for CVE-2026-101084.
For CVE-2026-101065, check whether your Obot container was started from the old quickstart without OBOT_SERVER_ENABLE_AUTHENTICATION=true.

03.

How to fix

Upgrade Obot to v0.21.1 or later.
Set OBOT_SERVER_ENABLE_AUTHENTICATION=true before exposing Obot to any untrusted network, and avoid mounting the Docker socket on a reachable instance.

docker inspect --format '{{.Config.Image}} {{range .Config.Env}}{{println .}}{{end}}' $(docker ps -q --filter ancestor=ghcr.io/obot-platform/obot) | grep -E 'obot|ENABLE_AUTHENTICATION'

04.

What it is

How to check

How to fix

Sources

One email a week. Only what changed.