# GHSA-6fwv-3h4c-37j9: Obot MCP Gateway GHSA-6fwv-3h4c-37j9 (CVSS 8.1): The Composite Route Skipped the Deny List, Reopening an MCP Access-Control Bypass

> GHSA-6fwv-3h4c-37j9 is a high-severity security issue (CVSS 8.1) in github.com/obot-platform/obot, a MCP server. Affected: github.com/obot-platform/obot >= 0.21.1, <= 0.24.1 (the advisory names no patched version; the checkUI rewrite ships from v0.25.0).. Fixed in 0.25.0.

- **Canonical URL:** https://catalog.anomity.ai/vuln/ghsa-6fwv-3h4c-37j9
- **Aliases:** ti-128
- **Severity:** high
- **CVSS:** 8.1
- **Attack type:** Other
- **Component:** github.com/obot-platform/obot (MCP server)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-09-17
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/ghsa-6fwv-3h4c-37j9

## Summary

Obot published repository advisory GHSA-6fwv-3h4c-37j9 on 17 September 2026, rated high (CVSS 3.1 8.1), credited to arpitjain099, with no CVE. The fix for the earlier GHSA-vw82-7fv8-r6gp (8 May 2026) added /mcp-connect/ to the UI-fallback deny list in pkg/api/authz/ui.go, but the gateway's composite route /mcp-connect-composite/{mcp_id} does not carry that prefix, reaches the same mcpGateway.Proxy handler, and fell through to checkUI's final `return true`, which on its own authorized the request. Any authenticated Obot user, including the Basic role, who had or could obtain a composite MCP ID could connect to and call tools on MCP servers that Access Control Rules restricted to specific groups. The reporter traced this in code and did not demonstrate it against a running instance. The advisory lists >= 0.21.1, <= 0.24.1 as affected and leaves the patched version blank, but commit 19035620 (30 July 2026), shipped in v0.25.0 on 31 July, changed checkUI to authorize only the UI fallback route, which closes the composite path; the reporter tested a commit from before that change. The advisory is not in the global GitHub Advisory Database, so Go dependency scanners will not flag it.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| github.com/obot-platform/obot >= 0.21.1, <= 0.24.1 (the advisory names no patched version; the checkUI rewrite ships from v0.25.0). | 0.25.0 |

## Am I affected by GHSA-6fwv-3h4c-37j9?

You are affected if you run github.com/obot-platform/obot >= 0.21.1, <= 0.24.1 (the advisory names no patched version; the checkUI rewrite ships from v0.25.0).. Versions 0.25.0 and later include the fix.

## How do I fix GHSA-6fwv-3h4c-37j9?

Upgrade Obot to v0.25.0 or later (v0.26.3 was current on 8 October 2026); those builds authorize UI-fallback traffic only on the "/" route, so /mcp-connect-composite/ requests go through the API-resource authorization check. If you cannot upgrade, block /mcp-connect-composite/ at the reverse proxy for users who should not use composite MCP servers. Review gateway logs for /mcp-connect-composite/ requests from Basic-role users to MCP servers outside their Access Control Rules, and rotate credentials held by restricted MCP servers where misuse cannot be ruled out.

## How do I find every machine running github.com/obot-platform/obot?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run github.com/obot-platform/obot and which version, then enforce a policy on it.

## References

- advisory: https://github.com/obot-platform/obot/security/advisories/GHSA-6fwv-3h4c-37j9

## Related vulnerabilities

- [CVE-2026-97662](https://catalog.anomity.ai/vuln/cve-2026-97662) — high
- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-115419](https://catalog.anomity.ai/vuln/cve-2026-115419) — high
- [GHSA-7xgj-8392-5q4r](https://catalog.anomity.ai/vuln/ghsa-7xgj-8392-5q4r) — medium
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=ghsa-6fwv-3h4c-37j9