Summary
Obot: Server-Side Request Forgery via remote MCP server URL
In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint (169.254.169.254), so a use with the Power User, Power User Plus, or Admin role can coerce Obot into making requests to internal services and to the cloud instance metadata service, and read the responses.
Am I affected?
You are affected if you run Obot <= v0.22.1 with authentication enabled and allow privileged users (with the Power User or higher privileges) to register remote MCP servers . The metadata-sync code path that triggers the fetch runs automatically during reconciliation, so no user interaction beyond registration is required.
Details
A remote server's URL (RemoteRuntimeConfig.URL) is accepted at registration after only checking that it is parseable and uses an http/https scheme, the destination is never constrained. Obot then connects to that URL when the server is launched or its OAuth state is checked, and the controller automatically fetches OAuth discovery metadata from it during reconcile. The one egress guard that exists (DisallowLocalhostMCP) is disabled by default, only blocks loopback when enabled, and is absent from the automatic metadata-fetch path. Because the fetched response body is reflected back in Obot's error messages, this is a non-blind SSRF.
Mitigation
Upgrade to v0.23.0 or later, which applies a single outbound egress chokepoint, rejecting loopback, link-local (including 169.254.169.254), RFC1918, and IPv6 ULA on the resolved IP at dial time, uniformly across the remote-MCP client and the OAuth-metadata client.
Severity
CVSS v3.1 Score: 7.6/10 (High), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Credits
The Obot team would like to thank HE WEI（ギカク）(https://www.linkedin.com/in/gikaku, @hewei-gikaku) for responsibly disclosing this issue in accordance with our security policy.
Impact
An attacker can reach internal-only services and the cloud metadata service if they have the Power User, Power User Plus, or Admin role. Against 169.254.169.254 this can disclose the host's cloud IAM credentials, enabling a pivot into the cloud account.
Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.
GHSA-JGH3-FGGC-MCPM has a CVSS score of 7.6 (High). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.23.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-JGH3-FGGC-MCPM? GHSA-JGH3-FGGC-MCPM is a high-severity server-side request forgery (SSRF) vulnerability in github.com/obot-platform/obot (go), affecting versions < 0.23.0. It is fixed in 0.23.0. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
- How severe is GHSA-JGH3-FGGC-MCPM? GHSA-JGH3-FGGC-MCPM has a CVSS score of 7.6 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/obot-platform/obot are affected by GHSA-JGH3-FGGC-MCPM? github.com/obot-platform/obot (go) versions < 0.23.0 is affected.
- Is there a fix for GHSA-JGH3-FGGC-MCPM? Yes. GHSA-JGH3-FGGC-MCPM is fixed in 0.23.0. Upgrade to this version or later.
- Is GHSA-JGH3-FGGC-MCPM exploitable, and should I be worried? Whether GHSA-JGH3-FGGC-MCPM is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-JGH3-FGGC-MCPM is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-JGH3-FGGC-MCPM? Upgrade
github.com/obot-platform/obotto 0.23.0 or later.