CVE-2026-105138: Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entryid} to obtain plaintext API keys or tokens and abuse them against backend services.
Affected Software
Event History
Frequently Asked Questions
Who can access the exposed secrets?
Any authenticated basic user who has been granted an MCP catalog entry through access-control rules can retrieve that entry's details. The issue affects static secrets configured on the entry by an administrator or power user.
What access and endpoint are required to exploit this issue?
An attacker needs valid authenticated access as a user permitted to use the relevant catalog entry. They can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens associated with that entry.
What versions are affected?
Obot versions from 0.12.0 before 0.26.2 are affected. Upgrading to 0.26.2 or later addresses the affected version range.
How can teams determine whether credentials may have been exposed?
Identify MCP catalog entries containing static API keys or tokens and review which basic users were granted those entries through access-control rules. Because permitted users could retrieve entry details in plaintext, treat static secrets on accessible entries as potentially disclosed.
What should be done if an immediate upgrade is not possible?
Restrict basic-user access to MCP catalog entries that contain static secrets, particularly through access-control rules. Rotate API keys and tokens configured on entries that may have been accessible to those users.