Mcphub
Monthly
Header passthrough in samanhappy MCPHub through 1.0.45 and 1.1.7 allows a non-admin server owner to configure an upstream server that forwards the invoking user's credentials - Authorization, Cookie, x-api-key, x-auth-token, proxy-authorization, or the deployment's configured bearer header - to an attacker-controlled endpoint. Exploitation requires a low-privileged account able to create or modify a server entry plus a victim actually invoking a tool on that server, after which a single credential header per invocation is disclosed (confidentiality-only, no integrity or availability impact; assessed CVSS 5.3). A public proof-of-concept writeup reference exists; it is not verified as working exploit code, there is no CISA KEV listing, and the vendor fix is released in v1.1.8 (commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76).
Improper privilege management in samanhappy MCPHub up to 1.0.32 lets any authenticated non-admin user import a configuration template that defines a 'privileged' server (a stdio server, any config carrying command/args, or any config with no remote target), which MCPHub then spawns locally as an operating-system command - resulting in arbitrary command execution as the MCPHub process. Exploitation only requires a valid low-privilege login and access to the Template Import Endpoint (CVSS 4.0 vector shows PR:L), and publicly available exploit code exists via GitHub issue #1094, so the practical risk is higher than the vendor's 5.3 score suggests; this assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is fixed in MCPHub 1.0.33, where importTemplate enforces the admin-only privileged-config policy.
MCPHub below version 0.11.0 allows unauthenticated attackers to bypass authentication on unprotected endpoints and perform actions with the privileges of other users. The vulnerability stems from missing authentication middleware on certain endpoints, enabling attackers on the local network (AV:A) to impersonate legitimate users without requiring credentials. No public exploit code or active exploitation has been confirmed at this time.
Improper authentication in MCPHub up to version 0.9.10 allows remote attackers to bypass authentication on the SSE connection handler. No active exploitation has been reported in CISA KEV, but public exploit code is available. EPSS 0.20% indicates low likelihood of widespread exploitation despite the public PoC.
Server-side request forgery (SSRF) in MCPHub up to version 0.9.10 allows authenticated high-privilege users to manipulate the baseUrl argument in the MCPRouter Service, enabling arbitrary HTTP requests from the server. The vulnerability requires high privilege level and has publicly available proof-of-concept code, though EPSS analysis suggests limited real-world exploitation probability despite active public disclosure.
OS command injection in MCPHub up to version 0.9.10 allows authenticated remote attackers to execute arbitrary system commands via manipulation of command/args parameters in serverController.ts. The vulnerability has a low CVSS score (2.1) due to requirement for authenticated access and limited scope impact, but carries elevated real-world risk given publicly available exploit code and vendor non-responsiveness. EPSS score of 0.25% suggests limited current exploitation activity despite POC availability.
Header passthrough in samanhappy MCPHub through 1.0.45 and 1.1.7 allows a non-admin server owner to configure an upstream server that forwards the invoking user's credentials - Authorization, Cookie, x-api-key, x-auth-token, proxy-authorization, or the deployment's configured bearer header - to an attacker-controlled endpoint. Exploitation requires a low-privileged account able to create or modify a server entry plus a victim actually invoking a tool on that server, after which a single credential header per invocation is disclosed (confidentiality-only, no integrity or availability impact; assessed CVSS 5.3). A public proof-of-concept writeup reference exists; it is not verified as working exploit code, there is no CISA KEV listing, and the vendor fix is released in v1.1.8 (commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76).
Improper privilege management in samanhappy MCPHub up to 1.0.32 lets any authenticated non-admin user import a configuration template that defines a 'privileged' server (a stdio server, any config carrying command/args, or any config with no remote target), which MCPHub then spawns locally as an operating-system command - resulting in arbitrary command execution as the MCPHub process. Exploitation only requires a valid low-privilege login and access to the Template Import Endpoint (CVSS 4.0 vector shows PR:L), and publicly available exploit code exists via GitHub issue #1094, so the practical risk is higher than the vendor's 5.3 score suggests; this assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is fixed in MCPHub 1.0.33, where importTemplate enforces the admin-only privileged-config policy.
MCPHub below version 0.11.0 allows unauthenticated attackers to bypass authentication on unprotected endpoints and perform actions with the privileges of other users. The vulnerability stems from missing authentication middleware on certain endpoints, enabling attackers on the local network (AV:A) to impersonate legitimate users without requiring credentials. No public exploit code or active exploitation has been confirmed at this time.
Improper authentication in MCPHub up to version 0.9.10 allows remote attackers to bypass authentication on the SSE connection handler. No active exploitation has been reported in CISA KEV, but public exploit code is available. EPSS 0.20% indicates low likelihood of widespread exploitation despite the public PoC.
Server-side request forgery (SSRF) in MCPHub up to version 0.9.10 allows authenticated high-privilege users to manipulate the baseUrl argument in the MCPRouter Service, enabling arbitrary HTTP requests from the server. The vulnerability requires high privilege level and has publicly available proof-of-concept code, though EPSS analysis suggests limited real-world exploitation probability despite active public disclosure.
OS command injection in MCPHub up to version 0.9.10 allows authenticated remote attackers to execute arbitrary system commands via manipulation of command/args parameters in serverController.ts. The vulnerability has a low CVSS score (2.1) due to requirement for authenticated access and limited scope impact, but carries elevated real-world risk given publicly available exploit code and vendor non-responsiveness. EPSS score of 0.25% suggests limited current exploitation activity despite POC availability.