Medium severity · published Oct 7, 2026
CVE-2026-105140
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership
4.2
CVSS
0.2%
EPSS
No
On KEV
Description
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
obot · obot-platform
0.25.0 before 0.25.6; 0.26.0 before 0.26.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105140
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105140
patch
https://github.com/obot-platform/obot/commit/6f81dac8d344cf6b2161f500460fb7b2a975c415
product
https://github.com/obot-platform/obot
vendor-advisory
https://github.com/obot-platform/obot/security/advisories/GHSA-929v-v9hq-5xhr
patch
https://github.com/obot-platform/obot/commit/09e4d5b5d1e4a5f35a6cbcff96f3c460c3f9e278
release-notes
https://github.com/obot-platform/obot/releases/tag/v0.26.1
technical-description
https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/group.go#L652-L734
More from obot
9.8
CVE-2026-101065
Obot Quickstart Docker Deployment Unauthenticated Admin Access
9.6
CVE-2026-101084
obot before v0.21.1 Authorization Bypass via /mcp-connect
8.8
CVE-2026-101062
Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration
8.1
CVE-2026-114662
Obot before 0.26.0 API Key Theft via CLI Login Token Request
8.1
CVE-2026-103758
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route