Topic

Cve 2026 103758

Coverage tagged cve 2026 103758.

Articles: 1
Desk: 1

Data graphic: a charcoal cover with a large red 8.6 for CVSS v4.0 High 8.1 under CVSS v3.1 and an ACR BYPASS stamp. The headline reads: Any login opens restricted MCP servers CVE-2026-103758 . Obot 0.21.1 to 0.24.1 is affected, v0.25.0 is the fix per Obot release notes, and no exploitation has been reported.

elevatedAI Security Cve 2026 103758

Obot MCP Gateway Flaw CVE-2026-103758 Lets Basic Users Reach Restricted MCP Servers

Obot 0.21.1–0.24.1 skips its ACR check on the composite MCP route, so any signed-in user can reach restricted servers. Obot says v0.25.0 fixes it.

Oct 2 · 5 min