CVE-2026-120323— samanhappy MCPHub passthroughHeaders.ts information disclosure

Quick assessment

Affected

samanhappy MCPHub

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 samanhappy MCPHub（版本 1.0.45 及 1.1.7 及以下）中发现一个安全漏洞。该漏洞影响文件 src/utils/passthroughHeaders.ts 中一个未知功能：对参数 passthroughHeaders 的操纵会导致信息泄露。攻击者可从远程发起攻击。建议升级至版本 1.1.8 以修复此问题，相关补丁提交哈希为 040f7b9ae004070bdfe5084cde6bc2c609f78e76。建议尽快升级受影响的组件。

CVSS 4.3 · Medium Updated Nov 02, 2026

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

samanhappy MCPHub passthroughHeaders.ts information disclosure

Source: CVE Program / CVE List V5

Vulnerability Description

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
samanhappy	MCPHub	1.0.0	`cpe:2.3:a:samanhappy:mcphub::::::::`

II. Public POCs for CVE-2026-120323

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120323

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-120323 (1)

CVE-2026-120323 | samanhappy MCPHub up to 1.0.45/1.1.7 passthroughHeaders.ts passthroughHeaders information disclosure vdb-entry technical-description

Other References for CVE-2026-120323 (6)

https://github.com/samanhappy/mcphub/releases/tag/v1.1.8 patch
https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md related
https://github.com/samanhappy/mcphub/commit/040f7b9ae004070bdfe5084cde6bc2c609f78e76 patch
https://vuldb.com/cve/CVE-2026-120323 third-party-advisory
https://vuldb.com/vuln/429655/cti signature permissions-required
https://vuldb.com/submit/1015029 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120323

IV. Related Vulnerabilities

Same product: MCPHub

Same vendor: samanhappy

Same weakness: CWE-200