EUVD-2026-83781
GHSA-2xcr-p42x-hfx6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as non-admin MCPHub user
-
DeliveryCraft template with stdio/command server config
-
ExploitPOST to Template Import Endpoint
-
ExecutionPrivilege check bypassed, config persisted
-
PersistMCPHub spawns command as its process
-
ImpactArbitrary host command execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated non-admin MCPHub account (PR:L) with access to the Template Import Endpoint, on MCPHub version <=1.0.32. The imported template must contain at least one 'privileged' server config - type 'stdio', or any config carrying a 'command'/'args', or any config lacking a remote target (no url and no OpenAPI url/schema) - since those are spawned locally as OS commands. Exploitation is limited by needing a valid low-privilege login and by the imported stdio server actually being started; it does not work against v1.0.33+, where importTemplate enforces the admin-only privileged-config policy. |
| Impact | This is a genuine authorization/privilege-escalation flaw whose real-world severity exceeds the vendor's 5.3 CVSS4.0 score. The vendor rated impact as VC:L/VI:L/VA:L, but the patch and regression tests confirm the actual consequence: a non-admin user can import a template containing a 'stdio'/command-carrying server config, which MCPHub spawns locally as its own OS process - i.e., arbitrary host command execution (effective RCE). The createServer/updateServer paths already enforced isPrivilegedServerConfig, but importTemplate never received the requesting user, so the same check was silently bypassed. Signals: PR:L (a valid low-privilege account is required, so not fully anonymous), AV:N/AC:L/UI:N (network-reachable, no user interaction), POC publicly available in GitHub issue #1094, and SSVC E:P (proof-of-exploit). No EPSS score and no CISA KEV listing are provided, and there is no evidence of active exploitation. Given the RCE-grade technical impact I dispute the vendor score upward to ~8.8 (CVSS 3.1); the main mitigating factor is the PR:L authentication requirement. Missing signals: no EPSS, no KEV, no independent exploit maturity beyond the issue report. |
| Exploit ScenarioDerived | An attacker holding an ordinary non-admin MCPHub account crafts a config template containing a server with type 'stdio' (or a bare 'command'/'args' with no remote url/OpenAPI target) and submits it to the Template Import Endpoint. Because importTemplate omitted the admin/privilege check that createServer enforces, the malicious stdio server is persisted and later spawned by MCPHub, executing the attacker's command on the host. A public proof-of-exploit exists in GitHub issue #1094, and the regression tests in the patch demonstrate the exact 'touch /tmp/pwned' / 'sh -c id' payloads. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Improper privilege management in samanhappy MCPHub up to 1.0.32 lets any authenticated non-admin user import a configuration template that defines a 'privileged' server (a stdio server, any config carrying command/args, or any config with no remote target), which MCPHub then spawns locally as an operating-system command - resulting in arbitrary command execution as the MCPHub process. Exploitation only requires a valid low-privilege login and access to the Template Import Endpoint (CVSS 4.0 vector shows PR:L), and publicly available exploit code exists via GitHub issue #1094, so the practical risk is higher than the vendor's 5.3 score suggests; this assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is fixed in MCPHub 1.0.33, where importTemplate enforces the admin-only privileged-config policy.
RemediationAI
Vendor-released patch: 1.0.33 - upgrade all MCPHub deployments from <=1.0.32 to v1.0.33 (release notes at https://github.com/samanhappy/mcphub/releases/tag/v1.0.33), or apply the upstream fix commit 18a4467bc4ec6390b1f841d8a468a37e9922f837 / PR https://github.com/samanhappy/mcphub/pull/1096, which adds isPrivilegedServerConfig to src/utils/serverConfigValidation.ts and passes the requesting user into importTemplate so non-admins cannot import stdio/command-carrying configs. If immediate upgrade is not possible, compensating controls are required because the flaw is a missing server-side authorization check: restrict the Template Import Endpoint at the reverse proxy or API gateway to admin-authenticated sessions only (this breaks legitimate non-admin template sharing and must be maintained until patched), and audit/limit who can hold any authenticated MCPHub account, since PR:L is the only prerequisite. As a detective control, inspect the MCPHub server registry for unexpected stdio servers or entries lacking url/OpenAPI targets, review process-spawn logs for the MCPHub service account, and treat any imported config containing 'command'/'args' as suspicious. Note that disabling or restricting imported stdio servers at runtime is only partial mitigation, because the command may execute depending on when the server is started; the upgrade to 1.0.33 is the only complete fix identified. There is no indication of a backport to pre-1.0.33 release lines in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MCPHub is a manager/hub for Model Context Protocol (MCP) servers that supports exporting and importing JSON configuration templates describing servers and groups. Template import originally flowed from templateController.importConfigTemplate into importTemplate(template, owner) in src/services/templateService.ts, with no caller identity passed down and therefore no authorization check on the imported server definitions. In MCPHub, a server config is 'privileged' when it can execute host commands: type 'stdio' servers spawn the supplied command/args as the MCPHub process, and any config lacking a remote target (no url and no OpenAPI url/schema) is treated as stdio-shaped. The createServer/updateServer paths already enforced an isPrivilegedServerConfig policy, but the template import path did not - the root cause class is CWE-269 (Improper Privilege Management), specifically a missing authorization check on a privileged operation (creation of command-executing server definitions) reachable by a non-admin. The fix extracts isPrivilegedServerConfig into src/utils/serverConfigValidation.ts, threads the requesting user into importTemplate, and rejects each privileged server for non-admins with a 'failed' detail item ('Only admins can import stdio-based server configurations') before any persistence or addServer call; trusted system callers that pass no requestingUser retain legacy behavior. A regression test (tests/services/templateService-import-privilege.test.ts) confirms non-admin imports of stdio and command-carrying configs are rejected while remote (sse/url) servers still import.
Know when Mcphub gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable endpoint, low complexity, requires a low-privilege authenticated account (PR:L); imported stdio config yields arbitrary host command execution, so C/I/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.33 is sufficient to resolve this issue. The identifier of the patch is 18a4467bc4ec6390b1f841d8a468a37e9922f837. It is advisable to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Improper authentication in MCPHub up to version 0.9.10 allows remote attackers to bypass authentication on the SSE conne
OS command injection in MCPHub up to version 0.9.10 allows authenticated remote attackers to execute arbitrary system co
Server-side request forgery (SSRF) in MCPHub up to version 0.9.10 allows authenticated high-privilege users to manipulat
MCPHub below version 0.11.0 allows unauthenticated attackers to bypass authentication on unprotected endpoints and perfo
Exploit-DB