CVE-2026-101064

Name of the Vulnerable Software and Affected Versions Obot versions prior to 0.23.0

Description Obot contains a server-side request forgery (SSRF) issue during remote MCP server registration. Privileged users with Power User, Power User Plus, or Admin roles can specify arbitrary URLs in the RemoteRuntimeConfig.URL variable without destination validation. The system fails to block requests to loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint (169.254.169.254). Consequently, an attacker can coerce the server into making requests to internal services and the cloud instance metadata service, reading the responses via error messages to disclose sensitive information, such as cloud IAM credentials.

Recommendations Upgrade to version 0.23.0 or later.