EUVD-2026-68689Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-accessible write endpoints require only a valid user session (PR:L); no special conditions apply; integrity is high as attacker-written DAO records override all users' prompt and resource responses.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user. The DAO singletons they write are consulted first - ahead of any connected MCP server - for every session in handleGetPromptRequest / handleReadResourceRequest. A non-admin can therefore create, overwrite, and shadow global prompt templates and resources that all other users are served. The scored impact is the unauthorized integrity violation (creation/tampering/shadowing of globally-served records); stored prompt injection into other users' LLM sessions is a downstream consequence of that tampering. This issue has been patched in version 1.0.32.
AnalysisAI
MCPHub's built-in prompt and resource management controllers expose mutating write endpoints (POST/PUT /api/prompts* and POST/PUT /api/resources*) to any authenticated user, not just admins, allowing low-privileged accounts to create, overwrite, and shadow global prompt templates and resources served to every active session. Affected versions prior to 1.0.32 attach these handlers to an authenticated router but include no admin-role gate; the DAO singletons written by these handlers take precedence over connected MCP server responses during prompt and resource resolution, meaning an attacker's injected templates silently reach all other users' LLM sessions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid MCPHub user account of any role - admin privileges are explicitly not required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, score 7.1) accurately captures a network-accessible, low-complexity integrity violation requiring only a valid user credential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MCPHub to version 1.0.32 or later; this is the only confirmed remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all MCPHub deployments running versions prior to 1.0.32 and audit logs for unauthorized modifications to prompts and resources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today