What is GHSA-x6jv-4hp7-3vj9?

GHSA-x6jv-4hp7-3vj9 is a security advisory published by GitHub Security Advisories with High severity. Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows...

Which CVE IDs does GHSA-x6jv-4hp7-3vj9 cover?

GHSA-x6jv-4hp7-3vj9 covers the following CVE IDs: CVE-2026-103758. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x6jv-4hp7-3vj9?

GHSA-x6jv-4hp7-3vj9 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-x6jv-4hp7-3vj9HighCVSS 8.1

Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows...

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-103758 →

📋 Description

Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route. Basic-role users with a composite MCP ID can proxy requests through mcpGateway.Proxy to invoke tools on MCP servers restricted by Access Control Rules.

🔗 References (4)

https://github.com/obot-platform/obot/security/advisories/GHSA-6fwv-3h4c-37j9
https://nvd.nist.gov/vuln/detail/CVE-2026-103758
https://www.vulncheck.com/advisories/obot-0.21.1-through-0.24.1-authorization-bypass-via-mcp-connect-composite-route
https://github.com/advisories/GHSA-x6jv-4hp7-3vj9