Obot: MCP Registry API readable without authentication
## Summary In affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not actually protect the MCP Registry endpoints under `/v0.1/*` — they remain readable by unauthenticated callers. ## Am I affected? You are affected if you run Obot `<= v0.22.1` with `OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`. An unauthenticated `GET /v0.1/servers` returns `200 OK` with catalog server metadata. (With registry auth disabled, the registry is intentionally public and this is not a defect.) ## Details The authorizer rejects a fixed set of known-protected prefixes and then default-allows everything else. The registry is mounted at the top-level `/v0.1` prefix, which was not in that set, so anonymous requests were authorized before the `WWW-Authenticate` challenge for `/v0.1` was ever reached. The registry handler still applies its own per-user ACR filtering, so an anonymous caller receives only entries accessible to the anonymous identity (e.g. default-catalog/wildcard entries), and responses contain names, descriptions, repository URLs, icons, and connect URLs — not secret env/header values. This is the same root cause as GHSA-vw82-7fv8-r6gp, whose fix protected `/mcp-connect/` but not the `/v0.1` registry prefix. ## Impact Worst case is disclosure of the registry server inventory (names, descriptions, repository URLs, connect URLs) that the operator explicitly chose to put behind authentication. No credential values are exposed and unauthenticated users
GHSA-pr6h-vr44-xq8j
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-pr6h-vr44-xq8j
github.com/obot-platform/obot
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.23.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.0"
}
]
}
],
"package": {
"name": "github.com/obot-platform/obot",
"purl": "pkg:golang/github.com/obot-platform/obot",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pr6h-vr44-xq8j/GHSA-pr6h-vr44-xq8j.json"
}
}
]- Related CVEs
- CVE-2026-101063
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #23390 · Revision 1
- Added to Heist Feed
- Publisher date
GO-2026-6525
Revision 1
Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot
Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-6525
github.com/obot-platform/obot
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.23.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.0"
}
]
}
],
"package": {
"name": "github.com/obot-platform/obot",
"purl": "pkg:golang/github.com/obot-platform/obot",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-6525.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-101063
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #23391 · Revision 1
- Added to Heist Feed
- Publisher date