CVE-2026-79747
HighCVSS 7.1Summary
MCPHub prior to version 1.0.32 allows an authenticated non-admin user to register a server pointing at an arbitrary URL and make the hub issue server-side requests to it, with no egress filtering (no block of loopback / RFC1918 / link-local). Via the OpenAPI proxy path the response body is returned to the caller (full, reflected SSRF); via the SSE/streamable-http transport the request is sent blind.
Risk Assessment
The organization is exposed to SSRF attacks that could allow access to internal resources such as cloud services, databases, or management systems. This could lead to data leakage and security breaches.
Recommendation
It is recommended to upgrade MCPHub to version 1.0.32 or later, which includes the fix. Also implement egress filtering and restrict server registration to trusted URLs only.
Other vulnerabilities in MCPHub
See all- CVE-2026-79750High
MCPHub prior to version 1.0.30 does not enforce ownership restrictions in the tool-execution API. Any authenticated non-admin user can invoke tools on MCP servers owned by other users, even if they cannot see those servers in GET /api/servers. This can lead to arbitrary host file read (e.g., /etc/passwd) and SSRF.
- CVE-2026-79749High
MCPHub prior to version 1.0.32 has an SSRF guard flaw in src/utils/ssrf.ts. The isBlockedIpv6 function only checks for loopback, link-local, unique-local, IPv4-mapped, and IPv4-compatible IPv6 addresses, but not IPv6 transition address families (NAT64, 6to4, Teredo). An attacker can encode a private IPv4 address in these IPv6 forms to bypass the guard and reach internal infrastructure.
- CVE-2026-79746High
MCPHub prior to version 1.0.31 has an authorization flaw for bearer keys with accessType 'servers' or 'custom' used against group routes. isBearerKeyAllowedForRequest grants access to the entire group as long as any single server in that group appears in the key's allowedServers list, without re-checking after authorization. A key scoped to one server also grants full access to every other server in the group.
- CVE-2026-79745High
MCPHub prior to version 1.0.32 does not perform role checking in the built-in prompt and resource controllers. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user. A non-admin can create, overwrite, and shadow global prompt templates and resources that all other users are served.
- CVE-2026-79744High
MCPHub prior to version 1.0.29 has a flaw in the PUT /api/system-config endpoint (handler updateSystemConfig) that performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter, but never inspects req.user.isAdmin.
- CVE-2026-79743Medium
MCPHub prior to version 0.12.13 has a vulnerability in the MCPB file upload handler. When extracting a ZIP file, the 'name' field in the manifest is directly concatenated into a file path without sanitization, allowing arbitrary file write via path traversal. The cleanupOldMcpbServer function also uses the unsanitized name, potentially allowing deletion of arbitrary directories. This issue has been patched in version 0.12.13.
- CVE-2026-79748Critical
MCPHub before version 0.12.15 lacks authorization checks for admin-only endpoints and does not sanitize command and args fields. Any authenticated non-admin user can execute arbitrary processes as the MCPHub server OS user, often root.
Original NVD description (English source)
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue server-side requests to it, with no egress filtering (no block of loopback / RFC1918 / link-local 169.254.0.0/16). Via the OpenAPI proxy path the response body is returned to the caller (full, reflected SSRF); via the SSE/streamable-http transport the request is sent blind. This issue has been patched in version 1.0.32.