CVE-2026-105139: obot 0.26.0 to before 0.26.2

Affected technology

obot · 0.26.0 to before 0.26.2
obot-platform

Description’s affected range: before 0.26.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates through the vMCP owner's shared component connection. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.