CVE-2026-108699

MediumCVSS 6.5

Published: 11/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.

Risk Assessment

The risk is the ability to execute unauthorized code in the hyper-mcp environment, potentially leading to host and data security compromise.

Recommendation

It is recommended to update hyper-mcp to a version that requires strict signer identity verification and restrict plugin sources to trusted registries.

Other vulnerabilities in hyper-mcp

CVE-2026-108698Medium
hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious manifest to the loader and a signed one to Cosign, executing unsigned WebAssembly plugins with configured host capabilities.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS