CVE-2026-101065: Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart

Obot, an open-source AI agent platform, had a security flaw in its Docker quickstart instructions where the application started without authentication enabled, meaning anyone accessing port 8080 could gain full administrative control and potentially run malicious code on the host system. The vulnerability affected all versions up to commit d7e6970 because the default setup gave unauthenticated users the highest privilege levels (Owner and Admin roles) and mounted the host's Docker control socket into the container.