hyper-mcp CVE-2026-108698

Exploitation requires that hyper-mcp (≤0.8.3) be configured to load WASM plugins from an OCI registry with Cosign signature verification enabled as the trust control. The attacker must be able to control or tamper with registry responses for the resolved tag (malicious/compromised registry, man-in-the-middle on the registry connection, or registry cache poisoning) and must win the time-of-check/time-of-use gap so that Cosign and the loader resolve the tag to different manifests. Limiting factors: the AT:P / race-condition requirement means the attacker needs an active position on the registry channel rather than a single unauthenticated request, and the ultimate impact is bounded by the host capabilities the operator granted to plugins; deployments that pin digests instead of mutable tags, or do not expose registry traffic to tampering, are not realistically exploitable.

This is a genuine, well-characterized supply-chain integrity flaw rather than a hollow high-CVSS entry, but its real-world urgency is tempered by exploitation prerequisites. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.3 and is dominated by VI:H - the core impact is execution of attacker-controlled, unsigned WebAssembly plugins with whatever host capabilities the operator configured. The AT:P (attack requirements present) metric is the critical qualifier: the attacker must be positioned to control registry responses for the OCI tag and win the time-of-check/time-of-use gap (CWE-367) between what Cosign verifies and what the loader actually pulls, serving a signed manifest to the verifier and an unsigned malicious one to the loader. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation - consistent with a recently disclosed research finding (VulnCheck advisory plus a hackmd technical writeup) rather than a mass-exploited bug. Net: credible and impactful for anyone running hyper-mcp with signature verification as their trust control, but exploitation is conditional on registry/network control, which bounds it toward targeted scenarios over opportunistic mass abuse.

An attacker who can manipulate OCI registry responses (via a compromised/malicious registry, MITM, or cache poisoning) serves hyper-mcp a signed, benign manifest when Cosign verifies the tag, then returns a different unsigned manifest pointing to a malicious WebAssembly plugin when load_wasm actually fetches it. hyper-mcp treats the plugin as verified and executes it with the configured host capabilities. No public exploit code was identified at time of analysis, though a detailed technical writeup of the TOCTOU exists.