CVE-2026-101063
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Sep 27, 2026
Vendor
unknown
Description
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.