MCPHub EUVD-2026-68684

Exploitation requires a valid authenticated session for any non-admin MCPHub account - no special role, group membership, or elevated privilege beyond basic login is needed. The attacker must know or be able to enumerate a target server's internal ID; because the list API does not expose cross-tenant servers, this requires ID guessing or brute-force, which is the only meaningful friction. The victim's MCP server must be connected and active at the time of invocation. The vulnerability is bounded to non-admin accounts only: admin users already possess full cross-tenant visibility by design, so the exploitable authorization gap exists solely on the non-admin permission boundary. No non-default configuration, feature flag, or specific MCP server type is required - the missing authorization check is in the core tool-execution routing layer affecting all server types.

The CVSS 3.1 score of 7.7 with S:C accurately captures the cross-tenant blast radius: a single low-privilege account can reach every other user's connected MCP server on the same instance. Attack complexity is Low with no user interaction required, making this trivially exploitable once an attacker holds any authenticated session. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified, but the minimal technical barrier suggests a short window between public awareness and active exploitation in exposed deployments. CISA KEV confirmation is not present. The asymmetry between the low cost of attack and the high-value capabilities exposed by MCP servers (production secrets, internal HTTP reach) means raw CVSS does not fully convey operational risk: instances aggregating cloud API keys or sensitive filesystem access are disproportionately exposed. The absence of integrity and availability impact in the CVSS vector is consistent with the described read-and-SSRF impact, though SSRF via victim-owned HTTP-fetch tools could enable limited lateral movement to internal services not directly captured by C:H alone. Defenders should not deprioritize this based on EPSS absence - the advisory itself demonstrates the attack path.

An attacker with any authenticated non-admin MCPHub account sends a crafted POST to the tool-execution API endpoint, supplying the internal identifier of another user's connected MCP server. Since the list API does not expose other users' servers to non-admins, the attacker iterates or guesses server IDs; once a valid ID is identified, the API executes the requested tool - such as a filesystem-read or HTTP-fetch tool - using the victim server's bound credentials, returning /etc/passwd contents, cloud API keys, or internal service responses without any error or access denial.