Obot-platform Obot vulnerabilities

• obot-platform obot Obot before 0.26.0 API Key Theft via CLI Login Token Request CVE-2026-114662 8.6 HighOctober 22, 2026
• obot-platform obot Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership CVE-2026-105140 2.3 LowOctober 7, 2026
• obot-platform obot Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources CVE-2026-105139 5.3 MediumOctober 7, 2026
• obot-platform obot Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API CVE-2026-105138 7.1 HighOctober 7, 2026
• obot-platform obot Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route CVE-2026-103758 8.6 HighOctober 1, 2026
• obot-platform obot Obot Quickstart Docker Deployment Unauthenticated Admin Access CVE-2026-101065 9.3 CriticalSeptember 27, 2026
• obot-platform obot Obot before v0.23.0 Server-Side Request Forgery via MCP CVE-2026-101064 Fix available 8.3 HighSeptember 18, 2026
• obot-platform obot Obot before v0.23.0 Authentication Bypass via Registry API CVE-2026-101063 Fix available 6.9 MediumSeptember 18, 2026
• obot-platform obot Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration CVE-2026-101062 Fix available 8.7 HighSeptember 18, 2026
• obot-platform obot obot before v0.21.1 Authorization Bypass via /mcp-connect CVE-2026-101084 Fix available 9.3 CriticalMay 13, 2026