GHSA-vw82-7fv8-r6gp: Authorization Bypass in Obot MCP Gateway via Insecure Route Configuration

Vulnerability ID: GHSA-VW82-7FV8-R6GP

CVSS Score: 9.3

Published: 2026-05-13

An authorization bypass vulnerability in the Obot MCP Gateway allows authenticated users to access arbitrary Model Context Protocol (MCP) servers without possessing the required Access Control Rules (ACR) or ownership privileges, leading to unauthorized interaction with external tools and data sources.

TL;DR

Authenticated users can bypass access controls to connect to any registered MCP server via the /mcp-connect/{id} endpoint due to a misconfigured global allowlist in the platform's authorization routing logic.

Technical Details

CWE ID : CWE-285

Attack Vector : Network

CVSS Score : 9.3

Privileges Required : Low (Authenticated)

Impact Context : Changed Scope (Access to external tools/data)

Patch Status : Patched in v0.21.1

Affected Systems

Obot MCP Gateway

Obot MCP Gateway : < 0.21.1 (Fixed in: v0.21.1 )

Mitigation…