CVE-2026-79748
CriticalCVSS 9.9Summary
MCPHub before version 0.12.15 lacks authorization checks for admin-only endpoints and does not sanitize command and args fields. Any authenticated non-admin user can execute arbitrary processes as the MCPHub server OS user, often root.
Risk Assessment
An authenticated attacker can execute arbitrary commands on the server, leading to full system compromise.
Recommendation
Update MCPHub to version 0.12.15 or later. Restrict API access to trusted users and use command allowlists.
Other vulnerabilities in MCPHub
See all- CVE-2026-79750High
MCPHub prior to version 1.0.30 does not enforce ownership restrictions in the tool-execution API. Any authenticated non-admin user can invoke tools on MCP servers owned by other users, even if they cannot see those servers in GET /api/servers. This can lead to arbitrary host file read (e.g., /etc/passwd) and SSRF.
- CVE-2026-79749High
MCPHub prior to version 1.0.32 has an SSRF guard flaw in src/utils/ssrf.ts. The isBlockedIpv6 function only checks for loopback, link-local, unique-local, IPv4-mapped, and IPv4-compatible IPv6 addresses, but not IPv6 transition address families (NAT64, 6to4, Teredo). An attacker can encode a private IPv4 address in these IPv6 forms to bypass the guard and reach internal infrastructure.
- CVE-2026-79747High
MCPHub prior to version 1.0.32 allows an authenticated non-admin user to register a server pointing at an arbitrary URL and make the hub issue server-side requests to it, with no egress filtering (no block of loopback / RFC1918 / link-local). Via the OpenAPI proxy path the response body is returned to the caller (full, reflected SSRF); via the SSE/streamable-http transport the request is sent blind.
- CVE-2026-79746High
MCPHub prior to version 1.0.31 has an authorization flaw for bearer keys with accessType 'servers' or 'custom' used against group routes. isBearerKeyAllowedForRequest grants access to the entire group as long as any single server in that group appears in the key's allowedServers list, without re-checking after authorization. A key scoped to one server also grants full access to every other server in the group.
- CVE-2026-79745High
MCPHub prior to version 1.0.32 does not perform role checking in the built-in prompt and resource controllers. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user. A non-admin can create, overwrite, and shadow global prompt templates and resources that all other users are served.
- CVE-2026-79744High
MCPHub prior to version 1.0.29 has a flaw in the PUT /api/system-config endpoint (handler updateSystemConfig) that performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter, but never inspects req.user.isAdmin.
- CVE-2026-79743Medium
MCPHub prior to version 0.12.13 has a vulnerability in the MCPB file upload handler. When extracting a ZIP file, the 'name' field in the manifest is directly concatenated into a file path without sanitization, allowing arbitrary file write via path traversal. The cleanupOldMcpbServer function also uses the unsanitized name, potentially allowing deletion of arbitrary directories. This issue has been patched in version 0.12.13.
Original NVD description (English source)
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spawn the configured stdio process via child_process.spawn. Authentication is required, but there is no authorization check restricting these endpoints to admins, and there is no allowlist/sanitization on the command and args fields. As a result, any authenticated non-admin user can submit a server configuration with command:"/bin/sh" (or any other binary) and arbitrary args, causing MCPHub to execute the attacker-controlled process as the MCPHub server's OS user (commonly root in the published Docker image and in npx/systemd deployments). This issue has been patched in version 0.12.15.