CVE-2026-103758: Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route
Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route. Basic-role users with a composite MCP ID can proxy requests through mcpGateway.Proxy to invoke tools on MCP servers restricted by Access Control Rules.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Obot deployments running versions 0.21.1 through 0.24.1 are affected where basic-role users can obtain or know a composite MCP ID and MCP servers are restricted by Access Control Rules.
What does an attacker need to exploit the bypass?
The attacker must be authenticated as a basic-role user and have a composite MCP ID. No user interaction is required; they can proxy requests through mcpGateway.Proxy using the omitted /mcp-connect-composite/ route.
What access can exploitation provide?
A successful attacker can invoke tools on MCP servers that should be restricted by Access Control Rules. The supplied severity vector indicates high confidentiality and integrity impact, with no availability impact.