CVE-2026-105138

{
  "etk_id": "ETK-2026-879",
  "cve_id": "CVE-2026-105138",
  "display_id": "CVE-2026-105138",
  "ghsa_id": "GHSA-q5wf-87f5-cxgq",
  "euvd_id": "EUVD-2026-94309",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Credential exposure through MCP catalog access controls in Obot",
  "summary": "Obot versions 0.12.0 through before 0.26.2 insufficiently protect static secrets configured on MCP catalog entries. An authenticated basic user granted access to an entry may obtain its plaintext API keys or tokens and use them against associated backend services.",
  "mitigation": "Upgrade Obot to version 0.26.2 or later. Rotate API keys and tokens configured on affected catalog entries, and restrict entry access to trusted users until the upgrade is complete.",
  "vendor": "obot-platform",
  "product": "obot",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.12.0, < 0.26.2"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "0.26.2"
      ],
      "package_name": "github.com/obot-platform/obot",
      "purl": "pkg:golang/github.com/obot-platform/obot"
    }
  ],
  "cwes": [
    522
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0026,
  "epss_percentile": 0.171,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 23.781815033333334,
  "t0_at": "2026-10-07T12:18:32.462000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T12:18:32.462000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T12:18:32.462000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105138"
    }
  }
}