Observations
Record the stated conditions before the layout note
Put each figure from the page on its own line. Do not mix in a preference.
app.opencve.io published this account (2026-09-27): Advisory aggregators dated 27 Sep describe Obot versions before v0.21.1 failing to enforce access-control rules on /mcp-connect, allowing an authenticated user with a server ID to reach restricted MCP servers and stored OAuth credentials.
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: Advisory aggregators dated 27 Sep describe Obot versions before v0.21.1 failing to enforce access-control rules on /mcp-connect, allowing an authenticated user with a server ID to reach restricted MCP servers and stored OAuth credentials.
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
Put each figure from the page on its own line. Do not mix in a preference.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: Aggregator listings: CVE-2026-101084 Obot /mcp-connect ACL bypass published 27 Sep.
Sources: Aggregator listings: CVE-2026-101084 Obot /mcp-connect ACL bypass published 27 Sep