CVE-2026-105138CWE-522

CVE-2026-105138

Medium · published October 7, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00263 · 17.3th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-10-07T17:17Z
References (7)
https://github.com/obot-platform/obot · [email protected]https://github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/authz/resources.go#L27 · [email protected]https://github.com/obot-platform/obot/blob/774972b92d86e0fbc7e0e9b36fdd06612859df9c/pkg/api/handlers/mcp.go#L206-L212 · [email protected]https://github.com/obot-platform/obot/commit/644a1fd60a66125ced3de10b350a983e933def7a · [email protected]https://github.com/obot-platform/obot/releases/tag/v0.26.2 · [email protected]https://github.com/obot-platform/obot/security/advisories/GHSA-q5wf-87f5-cxgq · [email protected]https://www.vulncheck.com/advisories/obot-0.12.0-before-0.26.2-credential-exposure-via-mcp-catalog-entry-api · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 12:18Z
    Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
    cvelistv5