CVE-2026-101084: Obot Authorization Bypass Lets Any User Reach Restricted MCP Servers

Overview

A second critical advisory for the Obot AI agent/MCP platform, disclosed the same day as CVE-2026-101065, targets a different layer of the stack: authorization, not authentication. CVE-2026-101084 affects Obot versions before 0.21.1 and stems from the /mcp-connect/{id} gateway endpoint failing to enforce Access Control Rules (ACRs) — the mechanism administrators use to restrict which users can reach which MCP servers.

The practical effect: any authenticated Obot user who knows or guesses an MCP server's ID can connect to it and invoke its tools, regardless of whether an administrator ever granted that user access. Rated CVSS 9.6 Critical, the flaw is tracked as GHSA-vw82-7fv8-r6gp and published September 27, 2026.

Technical Details

Exploitation status: No confirmed in-the-wild exploitation reported at time of publication; not listed in CISA's KEV catalog.

How It Works

Obot's intended access model routes an MCP connection through an OAuth-style flow: a user requests to connect to an MCP server URL, Obot's callback handler checks — correctly — whether that user is authorized for the requested resource, based on membership in an MCP Registry that grants access to specific servers.

The bug lives in a second, separate authorization check layered on top of that flow: what researchers describe as the "UI authorizer." Where the OAuth callback path enforces access correctly, the UI authorizer path erroneously granted access regardless of registry membership. Because the vulnerable /mcp-connect/{id} gateway endpoint didn't independently re-verify ACRs before proxying a session to the target MCP server, any authenticated user who obtained an MCP server's ID — whether by observing it in the UI, guessing a sequential or predictable identifier, or being told it by a colleague — could open a live connection to that server and begin issuing JSON-RPC calls (tools/list, tools/call) directly against it, using the server's own stored OAuth credentials.

This matters more than a typical unauthorized-read bug because MCP servers are integration points, not passive data stores. Many expose write-capable tools — the advisory cites examples like updateEmployee and submitTimeoffRequest — meaning a user who was never meant to see, let alone touch, a given backend system could use this bypass to modify HR records, create support tickets, or write to any other system the restricted MCP server was configured to manage. That is the basis for the vulnerability's CVSS Integrity: High rating: this isn't information disclosure, it's unauthorized write access to whatever the MCP server fronts.

Impact Assessment

Who Is At Risk

Any Obot deployment running a version before 0.21.1 with multiple MCP servers segmented by an MCP Registry — i.e., any organization relying on Obot's access controls to keep, say, an HR-integrated MCP server restricted to HR staff while other users only see a general-purpose server. Single-tenant deployments where every user is already trusted with every MCP server are lower-risk in practice, but still technically affected.

Potential Attack Chains

1. ID discovery — A low-privilege authenticated user obtains the ID of an MCP server they aren't authorized for, via UI enumeration, predictable identifiers, or social engineering of a colleague.
2. Gateway connection — The user issues a request to /mcp-connect/{mcp_id}, which the vulnerable versions accept without re-checking Access Control Rules.
3. Tool enumeration — The attacker calls tools/list against the now-open connection to discover what actions the restricted server exposes.
4. Unauthorized write — The attacker invokes write-capable tools (tools/call) using the MCP server's stored OAuth credentials, modifying backend records they were never authorized to touch — with the action logged, if at all, under the target server's own service identity rather than clearly attributed to the unauthorized user.

Mitigation

Immediate Actions

• Upgrade to Obot 0.21.1 or later immediately. Unlike CVE-2026-101065, this is a genuine code fix, not a documentation change — there is no safe configuration workaround on affected versions.
• Audit MCP server access logs from the affected period for connections from users who are not members of the MCP Registry associated with that server, particularly around write-capable tool invocations.
• Rotate credentials for any MCP server that fronts a sensitive backend (HR systems, ticketing, financial tools) if you cannot rule out unauthorized access during the exposure window.

Detection Opportunities

• Cross-reference /mcp-connect connection logs against MCP Registry membership records — any connection from a user without registry membership for that server ID is a strong indicator of exploitation.
• Look for tools/call invocations against sensitive backend integrations (HR, ticketing, finance) originating from accounts with no legitimate business reason to use that MCP server.
• Monitor for unusual clustering of MCP server ID lookups from a single user account, which may indicate enumeration attempts.

Defence-in-Depth

• Don't rely on MCP server IDs as a secret or as an implicit access boundary — treat this incident as confirmation that ID-based "security by obscurity" fails as soon as any authorization layer has a gap.
• Where possible, scope MCP server credentials as narrowly as the tools they expose require, so that even a successful authorization bypass yields limited-privilege access rather than a fully privileged service account.
• Review Obot's broader authorization architecture for other paths that might diverge between the OAuth-flow check and the UI-layer check — this advisory specifically calls out a discrepancy between two authorization enforcement points, which is a pattern worth auditing for elsewhere in the platform.

Background

CVE-2026-101084 was disclosed alongside CVE-2026-101065 on September 27, 2026, giving Obot two critical advisories in the same release window — one about a dangerous default (auth disabled out of the box) and one about an inconsistency between two authorization-enforcement code paths. Read together, they describe a platform where individual security controls existed but weren't uniformly applied across every entry point: the OAuth callback correctly checked registry membership, but the UI authorizer did not, and the quickstart deployment path disabled the underlying authentication check entirely. Teams running Obot — or evaluating any MCP gateway product — should treat "does every access path enforce the same authorization check" as a standing audit question, not a one-time review.

References

• NVD — CVE-2026-101084
• GitHub Security Advisory — GHSA-vw82-7fv8-r6gp