CVE-2026-79745
HighCVSS 7.1Summary
MCPHub prior to version 1.0.32 does not perform role checking in the built-in prompt and resource controllers. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user. A non-admin can create, overwrite, and shadow global prompt templates and resources that all other users are served.
Risk Assessment
The organization is exposed to integrity violations, as unauthorized users can modify global resources, which could lead to stored prompt injection into other users' LLM sessions and potential attacks.
Recommendation
It is recommended to upgrade MCPHub to version 1.0.32 or later, which includes the fix. Also implement role-based access control for all API routes.
Other vulnerabilities in MCPHub
See all- CVE-2026-79750High
MCPHub prior to version 1.0.30 does not enforce ownership restrictions in the tool-execution API. Any authenticated non-admin user can invoke tools on MCP servers owned by other users, even if they cannot see those servers in GET /api/servers. This can lead to arbitrary host file read (e.g., /etc/passwd) and SSRF.
- CVE-2026-79749High
MCPHub prior to version 1.0.32 has an SSRF guard flaw in src/utils/ssrf.ts. The isBlockedIpv6 function only checks for loopback, link-local, unique-local, IPv4-mapped, and IPv4-compatible IPv6 addresses, but not IPv6 transition address families (NAT64, 6to4, Teredo). An attacker can encode a private IPv4 address in these IPv6 forms to bypass the guard and reach internal infrastructure.
- CVE-2026-79747High
MCPHub prior to version 1.0.32 allows an authenticated non-admin user to register a server pointing at an arbitrary URL and make the hub issue server-side requests to it, with no egress filtering (no block of loopback / RFC1918 / link-local). Via the OpenAPI proxy path the response body is returned to the caller (full, reflected SSRF); via the SSE/streamable-http transport the request is sent blind.
- CVE-2026-79746High
MCPHub prior to version 1.0.31 has an authorization flaw for bearer keys with accessType 'servers' or 'custom' used against group routes. isBearerKeyAllowedForRequest grants access to the entire group as long as any single server in that group appears in the key's allowedServers list, without re-checking after authorization. A key scoped to one server also grants full access to every other server in the group.
- CVE-2026-79744High
MCPHub prior to version 1.0.29 has a flaw in the PUT /api/system-config endpoint (handler updateSystemConfig) that performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter, but never inspects req.user.isAdmin.
- CVE-2026-79743Medium
MCPHub prior to version 0.12.13 has a vulnerability in the MCPB file upload handler. When extracting a ZIP file, the 'name' field in the manifest is directly concatenated into a file path without sanitization, allowing arbitrary file write via path traversal. The cleanupOldMcpbServer function also uses the unsanitized name, potentially allowing deletion of arbitrary directories. This issue has been patched in version 0.12.13.
- CVE-2026-79748Critical
MCPHub before version 0.12.15 lacks authorization checks for admin-only endpoints and does not sanitize command and args fields. Any authenticated non-admin user can execute arbitrary processes as the MCPHub server OS user, often root.
Original NVD description (English source)
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user. The DAO singletons they write are consulted first — ahead of any connected MCP server — for every session in handleGetPromptRequest / handleReadResourceRequest. A non-admin can therefore create, overwrite, and shadow global prompt templates and resources that all other users are served. The scored impact is the unauthorized integrity violation (creation/tampering/shadowing of globally-served records); stored prompt injection into other users' LLM sessions is a downstream consequence of that tampering. This issue has been patched in version 1.0.32.