GO-2026-5678 : Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot
Discover Packages
github.com/obot-platform/obot
pkg
api
server
requestinfo
package
Version:
v0.21.1-rc3
Opens a new window with list of versions in this module.
Published: May 7, 2026
License: MIT
Opens a new window with license information.
Imports: 2
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Documentation
Documentation
¶
GetSourceIP extracts the real client IP address from the request.
It checks X-Forwarded-For and X-Real-IP headers before falling back to RemoteAddr.
Source Files
¶
Click to show internal directories.
Click to hide internal directories.