What is GHSA-63cq-34vq-4f48?

GHSA-63cq-34vq-4f48 is a security advisory published by GitHub Security Advisories with Medium severity. Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1...

Which CVE IDs does GHSA-63cq-34vq-4f48 cover?

GHSA-63cq-34vq-4f48 covers the following CVE IDs: CVE-2026-101063. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-63cq-34vq-4f48?

GHSA-63cq-34vq-4f48 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-63cq-34vq-4f48MediumCVSS 5.3

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1...

Vendor

GitHub Security Advisories

Published

September 27, 2026

Last Modified

September 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-101063 →

📋 Description

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.

🔗 References (4)

https://github.com/obot-platform/obot/security/advisories/GHSA-pr6h-vr44-xq8j
https://nvd.nist.gov/vuln/detail/CVE-2026-101063
https://www.vulncheck.com/advisories/obot-before-0.23.0-authentication-bypass-via-registry-api
https://github.com/advisories/GHSA-63cq-34vq-4f48