CVE-2026-105138 | BDVDB-2026-384276 Detail
obot-platformobot
Description#
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-522 Insufficiently Protected Credentials
References#
- https://github.com/obot-platform/obot/commit/644a1fd60a66125ced3de10b350a983e933def7a
- https://github.com/obot-platform/obot
- https://github.com/obot-platform/obot/security/advisories/GHSA-q5wf-87f5-cxgq
- https://github.com/obot-platform/obot/releases/tag/v0.26.2
- https://github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/authz/resources.go#L27
- https://github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/handlers/mcp.go#L206-L212
- https://www.vulncheck.com/advisories/obot-0.12.0-before-0.26.2-credential-exposure-via-mcp-catalog-entry-api
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.