EUVD-2026-68690Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible API requiring only a valid low-privilege session with no scope change, as impact is confined to the MCPHub instance itself.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter - it never inspects req.user.isAdmin. This issue has been patched in version 1.0.29.
AnalysisAI
Privilege escalation in MCPHub prior to version 1.0.29 allows any authenticated low-privilege user to modify system-wide configuration via the PUT /api/system-config endpoint. The handler updateSystemConfig never validates req.user.isAdmin, meaning the app-wide authentication middleware - which only confirms a valid session exists - is the sole barrier, granting any account holder effective administrative control over routing rules and server integrations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in MCPHub at any privilege level - no admin account is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is an accurate reflection of real-world exploitability: the only barrier is possession of any valid MCPHub account, and no configuration complexity is required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to MCPHub version 1.0.29 or later, available at https://github.com/samanhappy/mcphub/releases/tag/v1.0.29 per the vendor advisory at https://github.com/samanhappy/mcphub/security/advisories/GHSA-4gc8-885f-qj36. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately audit MCPHub user access logs for PUT requests to the /api/system-config endpoint and identify any unauthorized configuration changes; block or restrict network access to /api/system-config using firewall rules or API gateway ACLs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today