What is GHSA-jvrr-x58p-75mm?

GHSA-jvrr-x58p-75mm is a security advisory published by GitHub Security Advisories with High severity. Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server...

Which CVE IDs does GHSA-jvrr-x58p-75mm cover?

GHSA-jvrr-x58p-75mm covers the following CVE IDs: CVE-2026-101064. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jvrr-x58p-75mm?

GHSA-jvrr-x58p-75mm has a CVSS v3 base score of 7.6, published by GitHub Security Advisories.

GHSA-jvrr-x58p-75mmHighCVSS 7.6

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server...

Vendor

GitHub Security Advisories

Published

September 27, 2026

Last Modified

September 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-101064 →

📋 Description

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.

🔗 References (4)

https://github.com/obot-platform/obot/security/advisories/GHSA-jgh3-fggc-mcpm
https://nvd.nist.gov/vuln/detail/CVE-2026-101064
https://www.vulncheck.com/advisories/obot-before-0.23.0-server-side-request-forgery-via-mcp
https://github.com/advisories/GHSA-jvrr-x58p-75mm