CVE-2026-101065 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-101065 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-101065 is a critical remote unauthenticated access flaw in Obot’s documented Docker quickstart path. In versions up to and including commit d7e6970, the README quickstart starts Obot on 0.0.0.0:8080 with authentication disabled by default. If that port is reachable by an untrusted network, an attacker can access the Obot API and UI as a synthetic nobody user with Owner and Admin privileges.

That means full administrative control of the Obot instance, including the ability to register and launch attacker-controlled MCP servers. Because the quickstart also mounts /var/run/docker.sock into the container, this can extend to the host’s Docker control surface. This is a CRITICAL issue with a CVSS 9.8 score.

Immediate Action

  • Stop exposing Obot to untrusted networks now. If the service is reachable from the internet or a shared LAN, isolate it immediately with firewall rules or by binding it to localhost only.
  • Enable authentication before re-exposing the service. Set OBOT_SERVER_ENABLE_AUTHENTICATION=true and restart the container.
  • Review any MCP servers registered since deployment. Treat unknown or unexpected registrations as potentially attacker-controlled.
  • Inspect host impact. Because /var/run/docker.sock is mounted, check for unauthorized container creation, image pulls, or volume access on the host.
  • Follow vendor guidance. See the Obot security advisory / release notes for the latest documentation fix and deployment guidance.

Affected Versions

  • obot deployments using the README Docker quickstart from versions up to and including commit d7e6970 are vulnerable if authentication is left disabled.
  • OBOT_SERVER_ENABLE_AUTHENTICATION=false or unset in the exposed quickstart deployment is vulnerable.
  • Safe state: any deployment with OBOT_SERVER_ENABLE_AUTHENTICATION=true before exposure to untrusted networks.
  • Safe versions/tags: TODO_SAFE_VERSION and later, or any release whose quickstart documentation defaults to authentication enabled.

Resolution Guide

Docker / Compose

# Immediate hardening
export OBOT_SERVER_ENABLE_AUTHENTICATION=true

# If using docker run, restart with auth enabled and avoid public exposure
docker rm -f obot
docker run -d --name obot \
  -e OBOT_SERVER_ENABLE_AUTHENTICATION=true \
  -p 127.0.0.1:8080:8080 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  TODO_OBOT_IMAGE:TODO_TAG

Docker Compose example

services:
  obot:
    image: TODO_OBOT_IMAGE:TODO_TAG
    environment:
      OBOT_SERVER_ENABLE_AUTHENTICATION: "true"
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

JavaScript / Python / Java package managers

This issue is documented as a deployment/configuration flaw, not a library dependency bug. If you vendor Obot or wrap it in a package, update to the fixed release or docs revision:

# npm / yarn / pnpm
npm install TODO_OBOT_PACKAGE@TODO_SAFE_VERSION
yarn add TODO_OBOT_PACKAGE@TODO_SAFE_VERSION
pnpm add TODO_OBOT_PACKAGE@TODO_SAFE_VERSION

# pip / pipx
pip install -U TODO_OBOT_PACKAGE==TODO_SAFE_VERSION
pipx upgrade TODO_OBOT_PACKAGE

# Maven / Gradle
# Maven
mvn versions:use-latest-releases -Dincludes=TODO.group:TODO.artifact
# Gradle
./gradlew dependencyUpdates

# Linux package managers
sudo apt-get update && sudo apt-get install --only-upgrade TODO-obot
sudo yum update TODO-obot

Config hardening

# Required
OBOT_SERVER_ENABLE_AUTHENTICATION=true

# Recommended: bind locally or behind a trusted reverse proxy
# Example reverse proxy rule should restrict access by IP, VPN, or SSO

Minimal code/config fix example

# Before: insecure default
OBOT_SERVER_ENABLE_AUTHENTICATION=false

# After: secure default
OBOT_SERVER_ENABLE_AUTHENTICATION=true

Detection & Verification

Check whether you are vulnerable:

# Look for the quickstart command or auth setting
grep -RIn "OBOT_SERVER_ENABLE_AUTHENTICATION\|0.0.0.0:8080\|docker.sock" .

# Inspect the running container environment
docker inspect obot --format '{{range .Config.Env}}{{println .}}{{end}}' | grep OBOT_SERVER_ENABLE_AUTHENTICATION

# Confirm whether the service is publicly reachable
ss -lntp | grep ':8080'
curl -sS http://127.0.0.1:8080/ || true

Verify the fix:

# Expect authentication to be enabled
docker exec obot sh -lc 'echo "$OBOT_SERVER_ENABLE_AUTHENTICATION"'

# Confirm the port is not bound to all interfaces
ss -lntp | grep ':8080'
# Prefer 127.0.0.1:8080 or a private interface, not 0.0.0.0:8080

# Test that unauthenticated access is blocked
curl -i http://HOST:8080/ | head

Dependency and config audit tips: search CI/CD, Helm charts, systemd units, and README-based deployment scripts for 0.0.0.0:8080, OBOT_SERVER_ENABLE_AUTHENTICATION=false, and any direct mount of /var/run/docker.sock.

Risk and Impact

An attacker who can reach the exposed port gets full admin access without credentials. From there, they can create or control MCP servers, manipulate Obot data, and potentially use the mounted Docker socket to manage containers on the host. For solo developers and small teams, the blast radius can include source code, secrets, internal services, and the entire development machine or server.

Keep reading