MCPHub CVE-2025-11286

Exploitation requires the attacker to possess high-privilege (administrative) credentials or session access to MCPHub. The baseUrl parameter in src/controllers/serverController.ts must be exposed via an API endpoint or configuration interface accessible to authenticated high-privilege users. Default MCPHub deployments do not appear to have additional mitigations; however, if the MCPRouter Service is isolated to internal networks only or if baseUrl inputs are restricted to a whitelist of predefined hosts, exploitation is prevented. No user interaction (UI:N) is required beyond submitting the malicious configuration, but the attacker must already be authenticated and elevated within the MCPHub application.

Despite the public exploit availability (POC confirmed), risk is substantially mitigated by multiple factors: CVSS 2.0 score reflects high privilege requirement (PR:H), meaning only users with administrative or high-level access can trigger exploitation. EPSS score of 0.05% (15th percentile) indicates very low predicted exploitation probability in real environments, contradicting the assumption that public POC disclosure automatically drives widespread attack attempts. The vulnerability carries low impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), suggesting the SSRF is limited in scope-likely cannot execute code or cause denial of service, only request forgery. The non-responsive vendor (no patch released) combined with public disclosure creates a maintenance risk rather than an immediate critical threat. However, organizations deploying MCPHub with untrusted high-privilege users present a real lateral-movement or reconnaissance risk.

An administrator or high-privilege user of MCPHub discovers the baseUrl parameter in the MCPRouter Service configuration. They craft a malicious URL pointing to an internal service (e.g., http://localhost:27017/admin for MongoDB metadata or http://169.254.169.254/latest/meta-data for cloud instance credentials). Upon submitting the configuration, the MCPHub server initiates an outbound request to that URL, and the response is returned to or logged by the server, exposing sensitive internal data to the attacker without direct network access.