THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-pr6h-vr44-xq8j (medium) — Obot: MCP Registry API readable without authentication

[GHSA] GHSA-pr6h-vr44-xq8j (medium) — Obot: MCP Registry API readable without authentication

medgithub_advisoriesPublished 2026-09-18

GHSA-pr6h-vr44-xq8j Severity: medium CVE: None

Obot: MCP Registry API readable without authentication

## Summary

In affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not actually protect the MCP Registry endpoints under `/v0.1/*` — they remain readable by unauthenticated callers.

## Am I affected?

You are affected if you run Obot `<= v0.22.1` w

Original source: https://github.com/advisories/GHSA-pr6h-vr44-xq8j