CVE-2026-101084: obot MCP Server Authorization Bypass (CVSS 9.6) — Detection and Remediation Guide

The National Vulnerability Database has published CVE-2026-101084, a critical (CVSS 9.6) broken access control vulnerability in obot, a platform widely deployed to host, manage, and govern Model Context Protocol (MCP) servers. All obot versions prior to v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint. The practical consequence: any authenticated user who knows or guesses an MCP server ID can connect to restricted MCP servers they are not authorized to touch — and, critically, can issue MCP tool calls that execute under stored OAuth credentials belonging to the server's legitimate owner.

This is not a theoretical hardening gap. In modern MCP deployments, MCP servers are the connective tissue between AI agents and production backends: databases, cloud APIs, ticketing systems, code repositories, payment rails. An authorization bypass at the MCP gateway layer effectively collapses the entire permission model you've built on top of it. An attacker — or simply a curious insider with a low-privilege account — can enumerate or brute-force server IDs, attach to a privileged MCP server, and begin manipulating backend systems with the victim's delegated credentials. If your organization runs obot in front of internal MCP infrastructure, treat this as a drop-everything patching event.

Technical Analysis

Affected Products and Versions

• Product: obot (MCP server management / gateway platform)
• Affected versions: All versions before v0.21.1
• Fixed version: v0.21.1
• Vulnerability class: CWE-862 (Missing Authorization) / broken access control on a network-exposed API endpoint
• Attack vector: Network (remote), requiring only an authenticated low-privilege session

How the Vulnerability Works

The flaw lives in obot's handling of the /mcp-connect endpoint, which brokers client connections to registered MCP servers. Under the intended security model, obot evaluates Access Control Rules to determine whether a given authenticated user is permitted to connect to a specific MCP server instance. In vulnerable versions, that enforcement step is skipped: the endpoint accepts the connection request based on the server ID alone.

From a defender's perspective, the attack chain looks like this:

1. Foothold: The attacker obtains any authenticated session against the obot instance. This can be a legitimately provisioned low-privilege user (insider threat), a compromised service account, or — if obot's authentication is weak or SSO-scoped broadly — any employee credential.
2. Discovery: The attacker identifies target MCP server IDs. Depending on deployment, these may be predictable (sequential, slug-based, or derived from server names), enumerable through other API endpoints, or leaked through logs, tickets, and documentation.
3. Bypass: The attacker issues a connection request to /mcp-connect referencing the restricted server ID. Because Access Control Rules are not enforced, the connection succeeds.
4. Privilege escalation via delegation: The attacker invokes MCP tool calls on the restricted server. Those tool calls execute using stored OAuth credentials provisioned for the legitimate owner — meaning every action the attacker takes against the backend system (database queries, cloud API calls, file access) is attributed to, and authorized as, the victim identity.

That last step is what makes this vulnerability a 9.6 rather than a moderate authorization bug. The impact isn't limited to what the attacker's account can do — it inherits the full blast radius of whatever OAuth scopes were granted to the restricted MCP server's stored credentials. In environments where MCP servers are wired into production databases or cloud control planes with broad scopes, this is effectively full backend compromise with a single API call.

Exploitation Status

At the time of publication, there is no confirmed in-the-wild exploitation and CVE-2026-101084 has not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, defenders should not take comfort in that. The vulnerability is network-exploitable, requires no user interaction, and demands only a valid low-privilege session and a server ID — a remarkably low bar. Given the speed at which the offensive community weaponizes MCP/AI-infrastructure flaws (and the pace at which new MCP deployments are being stood up, often without mature hardening), assume public exploit paths will emerge quickly. Check the NVD entry and CISA KEV daily until your fleet is patched.

Detection & Response

Until patching is complete, you need visibility into who is hitting /mcp-connect and what they're doing afterward. The detections below focus on the two most reliable observables: unauthorized connection attempts against the endpoint, and anomalous MCP tool-call patterns flowing through stored credentials.

Sigma Rules

Deploy these against your reverse proxy / ingress / web server logs (normalize to a generic webserver logsource) and against endpoint telemetry from hosts running MCP-adjacent workloads. Tune the URI field to match your logging schema (e.g., cs-uri, url, request_uri).

---
title: obot MCP-Connect Endpoint Access Attempt
description: Detects HTTP requests to the obot /mcp-connect endpoint, which is the target of CVE-2026-101084 authorization bypass. Baseline legitimate usage first; alert on requests from users or source IPs outside the approved administrator/service-account population.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101084
author: Security Arsenal
date: 2026/02/11
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    c-uri|contains: '/mcp-connect'
  selection_method:
    cs-method:
      - 'POST'
      - 'GET'
      - 'CONNECT'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate users connecting to their authorized MCP servers — build an allowlist of expected user-agent and account pairs and alert on deviations
level: medium
---
title: Suspicious MCP Server ID Enumeration Against obot
description: Detects rapid sequential requests to /mcp-connect from a single source, consistent with brute-forcing or enumerating MCP server IDs to exploit CVE-2026-101084. Correlate at the SIEM layer for >10 distinct server IDs requested by one source IP or user within 5 minutes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101084
author: Security Arsenal
date: 2026/02/11
status: experimental
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains: '/mcp-connect'
    sc-status:
      - 200
      - 401
      - 403
      - 404
  condition: selection
falsepositives:
  - Health checks and monitoring probes — filter known monitoring service accounts and synthetic source IPs
level: high
---
title: MCP Server Process Spawning Unexpected Backend Client Tooling
description: Detects hosts running MCP server workloads spawning database shells, cloud CLIs, or HTTP tooling consistent with abuse of stored OAuth credentials following an authorization bypass on the MCP gateway.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101084
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/11
status: experimental
tags:
  - attack.execution
  - attack.t1059
  - attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\obot'
      - '\mcp'
      - 'node.exe'
      - 'python.exe'
  selection_child:
    Image|endswith:
      - '\psql.exe'
      - '\mysql.exe'
      - '\sqlcmd.exe'
      - '\az.exe'
      - '\aws.exe'
      - '\gcloud.exe'
      - '\curl.exe'
      - '\kubectl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate MCP server integrations — inventory which MCP servers are authorized to invoke which backend tools and alert only on out-of-baseline pairings
level: high

KQL — Microsoft Sentinel / Defender

The following hunt query targets proxy, firewall, and web-tier telemetry ingested into Sentinel. It surfaces sources hitting /mcp-connect across a breadth of server IDs or with unusual volume — the enumeration signature of CVE-2026-101084 exploitation. Run it against CommonSecurityLog (CEF-ingested proxy/WAF logs) and extend with the identity-join variant if you have sign-in context.

let lookback = 7d;
let ConnectRequests = CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where RequestURL contains "/mcp-connect" or RequestContext contains "/mcp-connect";
ConnectRequests
| summarize
    RequestCount = count(),
    DistinctServerIds = dcount(tostring(extract(@"server[_-]?id=([^&\s]+)", 1, RequestURL))),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    StatusCodes = make_set(DestinationPort),
    Methods = make_set(RequestMethod)
  by SourceIP, SourceUserName
| where RequestCount > 20 or DistinctServerIds > 5
| sort by DistinctServerIds desc, RequestCount desc;
// Identity pivot: surface low-privilege accounts connecting to servers they have never touched before
ConnectRequests
| summarize HistoricalFirstSeen = min(TimeGenerated) by SourceUserName, RequestURL
| where HistoricalFirstSeen >= ago(1d)
| project NewConnection_Time = HistoricalFirstSeen, SourceUserName, RequestURL;

If your obot instance fronts hosts monitored by Defender for Endpoint, pair this with a DeviceProcessEvents query for backend client tooling spawned under Node/Python MCP runtimes, mirroring the third Sigma rule above.

Velociraptor VQL

Use this artifact to hunt endpoints and MCP gateway hosts for anomalous outbound connections and child processes spawned from obot/MCP runtime processes — the follow-on activity you'd expect after a successful /mcp-connect bypass, when the attacker starts driving tool calls against backend systems with stolen delegated credentials.

-- Hunt for suspicious child processes and network connections from MCP runtime processes
-- Relevant to post-exploitation activity following CVE-2026-101084 abuse
LET suspicious_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(psql|mysql|sqlcmd|aws |az |gcloud|kubectl|curl|wget)'
  AND (Exe =~ '(obot|mcp|node|python)' OR Name =~ '(obot|mcp)')

SELECT Pid, Name, CommandLine, Username, CreateTime
FROM suspicious_procs
UNION ALL
SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(obot|mcp)'
  AND CommandLine =~ '(--transport|sse|stdio)'
ORDER BY CreateTime DESC

Complement this with a netstat sweep for unexpected outbound sessions from MCP runtime processes:

-- Enumerate network connections owned by MCP/obot runtime processes
SELECT Pid, Name, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ '(obot|mcp|node|python)'
  AND Status =~ 'ESTABLISHED'
  AND NOT Raddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

Remediation / Verification Script

Use the following Bash script to inventory obot deployments, verify the running version, and audit recent /mcp-connect activity in access logs prior to and after patching. Adjust paths to your deployment model (container, systemd, or Kubernetes).

#!/usr/bin/env bash
# CVE-2026-101084 — obot version verification and log audit helper
# Run on each host running obot, or adapt for your container orchestrator.

set -euo pipefail

VULN_CUTOFF="0.21.1"
echo "[*] Checking for obot deployments..."

# 1. Binary / systemd check
if command -v obot >/dev/null 2>&1; then
    VER=$(obot --version 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
    echo "[+] Local obot binary detected: version ${VER:-unknown}"
    if [ -n "${VER:-}" ]; then
        if [ "$(printf '%s\n%s\n' "$VER" "$VULN_CUTOFF" | sort -V | head -1)" = "$VULN_CUTOFF" ] && [ "$VER" != "$VULN_CUTOFF" ]; then
            echo "[OK] Version $VER is patched (>= $VULN_CUTOFF)."
        else
            echo "[!] VULNERABLE: obot $VER < $VULN_CUTOFF — upgrade immediately."
        fi
    fi
else
    echo "[-] No local obot binary on PATH."
fi

# 2. Container image check (Docker/Podman)
for runtime in docker podman; do
    if command -v "$runtime" >/dev/null 2>&1; then
        echo "[*] Checking $runtime images for obot..."
        "$runtime" images --format '{{.Repository}}:{{.Tag}}' | grep -i obot || echo "[-] No obot images found via $runtime."
        "$runtime" ps --format '{{.Names}} {{.Image}}' | grep -i obot || true
    fi
done

# 3. Kubernetes check (if kubectl is configured)
if command -v kubectl >/dev/null 2>&1; then
    echo "[*] Checking Kubernetes workloads for obot images..."
    kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}' \
        | grep -i obot || echo "[-] No obot workloads found in cluster."
fi

# 4. Audit recent /mcp-connect activity in common access log locations
echo "[*] Auditing access logs for /mcp-connect requests (last 30 days of rotated logs)..."
LOG_DIRS=("/var/log/nginx" "/var/log/apache2" "/var/log/obot" "/var/log/containers")
for d in "${LOG_DIRS[@]}"; do
    if [ -d "$d" ]; then
        echo "    -> $d"
        find "$d" -name '*.log*' -mtime -30 -print0 2>/dev/null | \
            xargs -0 zgrep -h 'mcp-connect' 2>/dev/null | \
            awk '{print $1}' | sort | uniq -c | sort -rn | head -20
    fi
done

echo "[*] Done. Review any source IPs with high /mcp-connect request counts for ID enumeration."

Remediation

1. Upgrade obot to v0.21.1 or later immediately. This is the only complete fix — it restores enforcement of Access Control Rules on /mcp-connect. Verify the version on every deployment surface: standalone binaries, container images, and Kubernetes workloads. Beware of pinned image tags in Helm charts or CI pipelines silently redeploying a vulnerable version.
2. Rotate stored OAuth credentials for every MCP server registered in obot. Because exploitation would have executed tool calls under victim identities, assume stored tokens on any internet- or intranet-reachable vulnerable instance are compromised. Rotate access tokens, refresh tokens, and client secrets — and scope replacements down to least privilege while you're in there.
3. Audit before and after patching. Pull 30–90 days of proxy/ingress logs for /mcp-connect requests. Flag: (a) sources connecting to many distinct server IDs, (b) low-privilege users connecting to MCP servers owned by other users, (c) bursts of 401/403/404 responses indicating ID enumeration. Cross-reference suspicious connections against backend system audit logs — the actions would be logged under the victim's OAuth identity, so look for that identity acting from unusual times, volumes, or data scopes.
4. Workarounds if you cannot patch today: Place /mcp-connect behind a restrictive network ACL or WAF rule permitting only known administrator/service-account source IPs; require step-up authentication (MFA claim) for any request to the path at your identity-aware proxy; or temporarily disable external MCP connections entirely. None of these are substitutes for the patch — an authenticated insider bypasses network ACLs trivially.
5. Harden the authorization model going forward. Make MCP server IDs non-predictable (UUIDs, not sequential integers or name slugs). Emit structured audit events for every /mcp-connect decision and ship them to your SIEM. Apply least-privilege OAuth scopes to stored credentials so a successful bypass has a bounded blast radius. Treat your MCP gateway with the same rigor you apply to your API gateway — because that is exactly what it is.
6. Monitor for escalation. Watch the NVD entry, the vendor's release notes and GitHub advisories, and the CISA KEV catalog. If KEV listing occurs, federal civilian agencies get a mandated remediation deadline — and your organization should treat that clock as its own.

Closing

CVE-2026-101084 is a textbook example of why AI infrastructure is the new perimeter. MCP gateways like obot concentrate delegated credentials and backend reach in a single control plane; a single missing authorization check converts that concentration into a skeleton key. Patch to v0.21.1, rotate your OAuth secrets, audit /mcp-connect history, and instrument the detections above so that if anyone probes this path in the future, your SOC sees it in minutes — not in a post-incident forensics report.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub