Obot's MCP gateway ships three advisories in one batch: SSRF to cloud metadata, unauthenticated registry, and OAuth token theft
All three Obot advisories published 2026-09-18 affect versions <= v0.22.1 of the MCP server platform. GHSA-xwmw-prc4-v3cr (8.8) is the worst architecturally: unauthenticated OAuth dynamic client registration accepted an arbitrary external redirect URI and auto-completed the flow with no consent screen, so one crafted link handed an attacker a token minted with the victim's full group set against the whole Obot API rather than the single MCP server requested. GHSA-jgh3-fggc-mcpm (7.6) fetches an attacker-registered remote MCP server URL server-side with no destination validation, reaching loopback, RFC1918 and [redacted]. GHSA-pr6h-vr44-xq8j shows OBOT_SERVER_ENABLE_REGISTRY_AUTH=true never actually protected /v0.1/*, because the authorizer default-allowed any prefix not on its known-protected list.
↳ Follow the thread