Hyper Mcp
Monthly
Improper signature verification in hyper-mcp through 0.8.3 lets an attacker who controls or substitutes the OCI plugin image reference load a malicious WebAssembly plugin, because cosign_verify_args() accepts any signer identity and any OIDC issuer by default - so a plugin image signed with an ordinary, freely obtainable Sigstore keyless certificate passes verification. Successful exploitation allows the malicious plugin to execute with whatever host, filesystem, and environment capabilities the operator has granted to plugins, yielding high integrity impact with limited confidentiality exposure. No public exploit code has been identified at time of analysis; exploitation is gated by the attacker's ability to gain control of the image reference the target resolves (as reflected by the AT:P attack-requirement metric), and blast radius is bounded by the privileges a least-privilege deployment actually grants plugins.
Signature verification bypass in hyper-mcp through 0.8.3 (src/wasm/oci.rs, load_wasm) lets an unauthenticated remote attacker who controls or tampers with OCI registry responses for a resolved tag load and execute unsigned WebAssembly plugins that were never covered by the Cosign signature check. The flaw is a time-of-check/time-of-use race (CWE-367): Cosign verifies a separately resolved tag while the loader consumes a different manifest, so a malicious registry can serve a signed manifest to the verifier and an unsigned malicious one to the plugin loader, with the payload then running under whatever host capabilities the operator granted. Exploitation is constrained - it requires signature-verified OCI plugin loading to be enabled, an active position on the registry channel, and winning the resolution race - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper signature verification in hyper-mcp through 0.8.3 lets an attacker who controls or substitutes the OCI plugin image reference load a malicious WebAssembly plugin, because cosign_verify_args() accepts any signer identity and any OIDC issuer by default - so a plugin image signed with an ordinary, freely obtainable Sigstore keyless certificate passes verification. Successful exploitation allows the malicious plugin to execute with whatever host, filesystem, and environment capabilities the operator has granted to plugins, yielding high integrity impact with limited confidentiality exposure. No public exploit code has been identified at time of analysis; exploitation is gated by the attacker's ability to gain control of the image reference the target resolves (as reflected by the AT:P attack-requirement metric), and blast radius is bounded by the privileges a least-privilege deployment actually grants plugins.
Signature verification bypass in hyper-mcp through 0.8.3 (src/wasm/oci.rs, load_wasm) lets an unauthenticated remote attacker who controls or tampers with OCI registry responses for a resolved tag load and execute unsigned WebAssembly plugins that were never covered by the Cosign signature check. The flaw is a time-of-check/time-of-use race (CWE-367): Cosign verifies a separately resolved tag while the loader consumes a different manifest, so a malicious registry can serve a signed manifest to the verifier and an unsigned malicious one to the plugin loader, with the payload then running under whatever host capabilities the operator granted. Exploitation is constrained - it requires signature-verified OCI plugin loading to be enabled, an active position on the registry channel, and winning the resolution race - and no public exploit code or confirmed active exploitation was identified at time of analysis.