Skip to contentSamanhappy Mcphub vulnerabilities
- mcphubsamanhappy MCPHub passthroughHeaders.ts information disclosureCVE-2026-1203235.3 Medium
- mcphubsamanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges managementCVE-2026-940475.3 Medium
- mcphubMCPHub before 1.0.32 OAuth 2.0 Authentication BypassCVE-2026-904747.6 High
- mcphubMCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security ConfigurationCVE-2026-797448.8 High
- mcphubMCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)CVE-2026-797457.1 High
- mcphubMCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matchingCVE-2026-797468.1 High
- mcphubMCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)CVE-2026-797477.1 High
- mcphubMCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)CVE-2026-797489.9 Critical
- mcphubMCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL ValidationCVE-2026-797497.6 High
- mcphubMCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)CVE-2026-797507.7 High
- mcphubMCPHub: Path Traversal via Malicious MCPB Manifest NameCVE-2026-79743Fix available6.9 Medium
- mcphubsamanhappy MCPHub sseService.ts handleSseConnectionfunction improper authenticationCVE-2025-112876.9 Medium
- mcphubsamanhappy MCPHub MCPRouter Service serverController.ts server-side request forgeryCVE-2025-112865.1 Medium
- mcphubsamanhappy MCPHub serverController.ts os command injectionCVE-2025-112855.3 Medium