Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

MCPHub — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in MCPHub, with AI-generated Chinese analysis, references, and POCs.

Vendor: samanhappy

CVE ID Title CVSS Severity Published
CVE-2026-94047 samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management CWE-269 6.3 Medium 2026-09-20
CVE-2026-90474 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass CWE-287 6.8 Medium 2026-09-12
CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name CWE-22 6.9 Medium 2026-08-31
CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration CWE-269 8.8 High 2026-08-31
CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources) CWE-862 7.1 High 2026-08-31
CVE-2026-79746 MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching CWE-863 8.1 High 2026-08-31
CVE-2026-79747 MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial) CWE-918 7.1 High 2026-08-31
CVE-2026-79748 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args) CWE-862 9.9 Critical 2026-08-31
CVE-2026-79749 MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation CWE-918 7.6 High 2026-08-31
CVE-2026-79750 MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF) CWE-639 7.7 High 2026-08-31
CVE-2025-13822 Authentication bypass in MCPHub CWE-639 8.8 - 2026-04-14
CVE-2025-11287 samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication CWE-287 7.3 High 2025-10-05
CVE-2025-11286 samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery CWE-918 4.7 Medium 2025-10-05
CVE-2025-11285 samanhappy MCPHub serverController.ts os command injection CWE-78 6.3 Medium 2025-10-05

All 14 known CVE vulnerabilities affecting MCPHub with full Chinese analysis, references, and POCs where available.