hyper-mcp EUVD-2026-96999

Exploitation requires hyper-mcp (through 0.8.3) to be relying on its default cosign signature verification, where cosign_verify_args() does not pin an allowed signer identity or OIDC issuer - so any valid Sigstore keyless certificate is accepted. The attacker must also be able to control or substitute the plugin image reference the target loads (e.g., via a typosquatted/attacker-owned OCI image, registry path control, or the manifest TOCTOU/substitution described in the advisory). Impact is bounded by the host, filesystem, and environment capabilities the operator explicitly granted to plugins, which limits blast radius in least-privilege deployments; the AT:P metric reflects that the attacker must achieve this image-reference control rather than exploit a default-open network service.

The input CVSS 4.0 base score of 8.3 (High) reflects a network vector (AV:N) with low complexity (AC:L) but an explicit attack requirement (AT:P) and unauthenticated access (PR:N/UI:N), with impact weighted toward integrity (VI:H) and minor confidentiality (VC:L). This is a code-execution/trust-bypass issue (CWE-347), not primarily data disclosure. No EPSS score, no CISA KEV entry, and no public exploit flag were provided in the input, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation - the AT:P metric and the requirement that an attacker control a plugin image reference indicate this is a targeted, supply-chain-style weakness rather than an opportunistic internet-wide one. The severity is genuine for anyone running hyper-mcp with the default (unpinned) cosign verification, because the security control (signature verification) is effectively defeated by accepting any Sigstore keyless identity; however, real-world risk is tempered by the niche footprint of the product and the precondition that the attacker must influence which image the target loads. Net: a real, well-documented design flaw worth prioritizing for hyper-mcp operators, but not a mass-exploitation emergency given the missing EPSS/KEV signals and the required attacker position.

An attacker who can influence a plugin image reference used by a hyper-mcp deployment (via typosquatting, a compromised registry path, or manifest substitution/TOCTOU as described in the VulnCheck/hackmd write-up) obtains a free Sigstore keyless certificate and signs a malicious WebAssembly plugin. Because cosign_verify_args() accepts any signer identity and OIDC issuer by default, hyper-mcp treats the image as validly signed and loads it, executing the attacker's code with whatever host, filesystem, and environment capabilities the operator configured. No public exploit is flagged in the input, but the advisory includes detailed source-line analysis of the flaw.