{
  "entry": {
    "kind": "vuln",
    "slug": "ghsa-6fwv-3h4c-37j9",
    "name": "GHSA-6fwv-3h4c-37j9",
    "vendor": "github.com/obot-platform/obot",
    "description": "Obot published repository advisory GHSA-6fwv-3h4c-37j9 on 17 September 2026, rated high (CVSS 3.1 8.1), credited to arpitjain099, with no CVE. The fix for the earlier GHSA-vw82-7fv8-r6gp (8 May 2026) added /mcp-connect/ to the UI-fallback deny list in pkg/api/authz/ui.go, but the gateway's composite route /mcp-connect-composite/{mcp_id} does not carry that prefix, reaches the same mcpGateway.Proxy handler, and fell through to checkUI's final `return true`, which on its own authorized the request. Any authenticated Obot user, including the Basic role, who had or could obtain a composite MCP ID could connect to and call tools on MCP servers that Access Control Rules restricted to specific groups. The reporter traced this in code and did not demonstrate it against a running instance. The advisory lists >= 0.21.1, <= 0.24.1 as affected and leaves the patched version blank, but commit 19035620 (30 July 2026), shipped in v0.25.0 on 31 July, changed checkUI to authorize only the UI fallback route, which closes the composite path; the reporter tested a commit from before that change. The advisory is not in the global GitHub Advisory Database, so Go dependency scanners will not flag it.",
    "website": "https://github.com/obot-platform/obot/security/advisories/GHSA-6fwv-3h4c-37j9",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-17",
    "risk": {
      "score": 81,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "GHSA-6fwv-3h4c-37j9",
      "aliases": [
        "ti-128"
      ],
      "title": "Obot MCP Gateway GHSA-6fwv-3h4c-37j9 (CVSS 8.1): The Composite Route Skipped the Deny List, Reopening an MCP Access-Control Bypass",
      "summary": "Obot published repository advisory GHSA-6fwv-3h4c-37j9 on 17 September 2026, rated high (CVSS 3.1 8.1), credited to arpitjain099, with no CVE. The fix for the earlier GHSA-vw82-7fv8-r6gp (8 May 2026) added /mcp-connect/ to the UI-fallback deny list in pkg/api/authz/ui.go, but the gateway's composite route /mcp-connect-composite/{mcp_id} does not carry that prefix, reaches the same mcpGateway.Proxy handler, and fell through to checkUI's final `return true`, which on its own authorized the request. Any authenticated Obot user, including the Basic role, who had or could obtain a composite MCP ID could connect to and call tools on MCP servers that Access Control Rules restricted to specific groups. The reporter traced this in code and did not demonstrate it against a running instance. The advisory lists >= 0.21.1, <= 0.24.1 as affected and leaves the patched version blank, but commit 19035620 (30 July 2026), shipped in v0.25.0 on 31 July, changed checkUI to authorize only the UI fallback route, which closes the composite path; the reporter tested a commit from before that change. The advisory is not in the global GitHub Advisory Database, so Go dependency scanners will not flag it.",
      "severity": "high",
      "cvss": {
        "score": 8.1,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Other"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "github.com/obot-platform/obot",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "github.com/obot-platform/obot >= 0.21.1, <= 0.24.1 (the advisory names no patched version; the checkUI rewrite ships from v0.25.0).",
          "fixed": "0.25.0"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-17",
      "modifiedAt": "2026-09-17",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://github.com/obot-platform/obot/security/advisories/GHSA-6fwv-3h4c-37j9"
        }
      ],
      "mitigation": "Upgrade Obot to v0.25.0 or later (v0.26.3 was current on 8 October 2026); those builds authorize UI-fallback traffic only on the \"/\" route, so /mcp-connect-composite/ requests go through the API-resource authorization check. If you cannot upgrade, block /mcp-connect-composite/ at the reverse proxy for users who should not use composite MCP servers. Review gateway logs for /mcp-connect-composite/ requests from Basic-role users to MCP servers outside their Access Control Rules, and rotate credentials held by restricted MCP servers where misuse cannot be ruled out.",
      "detectedByAnomity": true
    }
  }
}