GHSA-pr6h-vr44-xq8j: Obot: MCP Registry API readable without authentication

September 18, 2026

In affected versions, enabling registry authentication (OBOT_SERVER_ENABLE_REGISTRY_AUTH=true) does not actually protect the MCP Registry endpoints under /v0.1/* — they remain readable by unauthenticated callers.

References

github.com/advisories/GHSA-pr6h-vr44-xq8j
github.com/obot-platform/obot/releases/tag/v0.23.0
github.com/obot-platform/obot/security/advisories/GHSA-pr6h-vr44-xq8j

Code Behaviors & Features

Detect and mitigate GHSA-pr6h-vr44-xq8j with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →