Skip to content
Heist/ feed
MediumFix available

Obot: MCP Registry API readable without authentication

Type: advisorySource: OSV1 source record

## Summary In affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not actually protect the MCP Registry endpoints under `/v0.1/*` — they remain readable by unauthenticated callers. ## Am I affected? You are affected if you run Obot `<= v0.22.1` with `OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`. An unauthenticated `GET /v0.1/servers` returns `200 OK` with catalog server metadata. (With registry auth disabled, the registry is intentionally public and this is not a defect.) ## Details The authorizer rejects a fixed set of known-protected prefixes and then default-allows everything else. The registry is mounted at the top-level `/v0.1` prefix, which was not in that set, so anonymous requests were authorized before the `WWW-Authenticate` challenge for `/v0.1` was ever reached. The registry handler still applies its own per-user ACR filtering, so an anonymous caller receives only entries accessible to the anonymous identity (e.g. default-catalog/wildcard entries), and responses contain names, descriptions, repository URLs, icons, and connect URLs — not secret env/header values. This is the same root cause as GHSA-vw82-7fv8-r6gp, whose fix protected `/mcp-connect/` but not the `/v0.1` registry prefix. ## Impact Worst case is disclosure of the registry server inventory (names, descriptions, repository URLs, connect URLs) that the operator explicitly chose to put behind authentication. No credential values are exposed and unauthenticated users

Announced Source revision 1
Original source ↗

GHSA-pr6h-vr44-xq8j

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-pr6h-vr44-xq8j

github.com/obot-platform/obot

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
0.23.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0.23.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/obot-platform/obot",
      "purl": "pkg:golang/github.com/obot-platform/obot",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pr6h-vr44-xq8j/GHSA-pr6h-vr44-xq8j.json"
    }
  }
]
Related CVEs
CVE-2026-101063

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-101063 · Medium

obot

Event
#23390 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement