github.com/obot-platform/obot
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- 8 advisory(ies) without a verdict
Advisories (8)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-jgh3-fggc-mcpm Obot: Server-Side Request Forgery via remote MCP server URL | < 0.23.0 | Undetermined |
| GHSA-pr6h-vr44-xq8j Obot: MCP Registry API readable without authentication | < 0.23.0 | Undetermined |
| GHSA-vw82-7fv8-r6gp Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server | < 0.21.1 | Undetermined |
| GHSA-xwmw-prc4-v3cr Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion | < 0.23.0 | Undetermined |
| GO-2026-5678 Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot | < 0.21.1 | Undetermined |
| GO-2026-6522 Obot: Server-Side Request Forgery via remote MCP server URL in github.com/obot-platform/obot | < 0.23.0 | Undetermined |
| GO-2026-6525 Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot | < 0.23.0 | Undetermined |
| GO-2026-6530 Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot | < 0.23.0 | Undetermined |
Sources
| Source | Licence |
|---|