EUVD-2026-68685Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AT:P maps to AC:H; PR:L for required auth; S:C because SSRF reaches internal systems beyond MCPHub itself; no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, MCPHub's SSRF guard in src/utils/ssrf.ts uses a custom isBlockedIpv6 function that only checks for loopback, link-local, unique-local, IPv4-mapped, and IPv4-compatible IPv6 addresses. IPv6 transition address families -- NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32) -- are not checked. An attacker who can specify a URL for an MCP server connection can encode a private IPv4 address inside one of these IPv6 forms to bypass the SSRF guard and reach internal infrastructure. This issue has been patched in version 1.0.32.
AnalysisAI
MCPHub's SSRF guard can be circumvented by authenticated users who supply MCP server URLs containing IPv6 transition-format addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, or Teredo 2001::/32) that encode private IPv4 addresses, allowing requests to internal infrastructure the guard was designed to block. Versions prior to 1.0.32 are affected; the custom isBlockedIpv6 function in src/utils/ssrf.ts omits checks for these three address families. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold valid MCPHub credentials with permission to specify URLs when configuring MCP server connections (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 with AT:P (attack requirement present) and PR:L (low privilege required) accurately captures that this is not zero-effort exploitation - valid MCPHub credentials with server-configuration privileges are a prerequisite, and some deployment-specific condition (AT:P) must be met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MCPHub to version 1.0.32 or later, which patches the isBlockedIpv6 function to additionally block NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32) IPv6 transition address ranges. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MCPHub deployments and their current versions, prioritizing production systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today