Login Request a demo
Medium severity · published Oct 7, 2026
CVE-2026-105138
Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
obot · obot-platform
0.12.0 before 0.26.2 · source: vendor
Affected product
OB
obot
obot-platform
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105138
patch
https://github.com/obot-platform/obot/commit/644a1fd60a66125ced3de10b350a983e933def7a
product
https://github.com/obot-platform/obot
vendor-advisory
https://github.com/obot-platform/obot/security/advisories/GHSA-q5wf-87f5-cxgq
release-notes
https://github.com/obot-platform/obot/releases/tag/v0.26.2
technical-description
https://github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/authz/resources.go#L27
technical-description
https://github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/handlers/mcp.go#L206-L212
More from obot
9.8
CVE-2026-101065
Obot Quickstart Docker Deployment Unauthenticated Admin Access
9.6
CVE-2026-101084
obot before v0.21.1 Authorization Bypass via /mcp-connect
8.8
CVE-2026-101062
Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration
8.1
CVE-2026-114662
Obot before 0.26.0 API Key Theft via CLI Login Token Request
8.1
CVE-2026-103758
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route