CVE-2026-105138
Deferred Deferred - Pending Action

Obot MCP Catalog Entry Static Secrets Exposure

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: VulnCheck

Description
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-105138
EUVD
EUVD-2026-94309

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
obot-platform obot 0.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105138 is an insufficiently protected credentials vulnerability in Obot versions 0.12.0 through 0.26.1. It allows authenticated users to read static secrets like API keys or tokens set by admins or power users on MCP catalog entries. Basic users with entry access can exploit the GET /api/all-mcps/entries/{entry_id} endpoint to retrieve these plaintext credentials and misuse them against backend services.

Detection Guidance

To detect this vulnerability, check Obot versions between 0.12.0 and 0.26.1. Look for unauthorized access to static secrets via the GET /api/all-mcps/entries/{entry_id} endpoint. Review API logs for suspicious requests to this path. Use Obot CLI commands to inspect MCP catalog entries for exposed credentials.

Impact Analysis

This vulnerability can lead to credential theft and unauthorized access to backend services. Attackers could abuse exposed API keys or tokens to interact with systems, potentially causing data breaches, service disruptions, or further lateral movement within an organization's infrastructure.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing sensitive credentials, leading to unauthorized data access. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Unauthorized credential exposure risks non-compliance and potential legal penalties.

Mitigation Strategies

Upgrade Obot to version 0.26.2 or later immediately. Rotate all static API keys, tokens, or credentials stored in MCP catalog entries. Review and re-encrypt any exposed secrets. Verify access controls for all users and entries after upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart