MCPHub vulnerabilities

9 known vulnerabilities in MCPHub from Samanhappy. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  mcphub: Authorization Bypass Through User-Controlled Key

  CVE-2026-79750Aug 31, 2026Samanhappy

  MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own (list views and config e

• 7.6 High severity

  mcphub: Server-Side Request Forgery

  CVE-2026-79749Aug 31, 2026Samanhappy

  MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, MCPHub's SSRF guard in src/utils/ssrf.ts uses a custom isBlockedIpv6 funct

• 9.9 Critical severity

  mcphub: Missing Authorization

  CVE-2026-79748Aug 31, 2026Samanhappy

  MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub crea

• 7.1 High severity

  mcphub: Server-Side Request Forgery

  CVE-2026-79747Aug 31, 2026Samanhappy

  MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbit

• 8.1 High severity

  mcphub: Incorrect Authorization

  CVE-2026-79746Aug 31, 2026Samanhappy

  MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' (or 'custom') is used against

• 7.1 High severity

  mcphub: Missing Authorization

  CVE-2026-79745Aug 31, 2026Samanhappy

  MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The

• 8.8 High severity

  mcphub: Improper Privilege Management

  CVE-2026-79744Aug 31, 2026Samanhappy

  MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) perf

• 9.8 Critical severity

  MCPHub: Improper Authentication

  CVE-2025-11287Oct 5, 2025Samanhappy

  A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack may be launched remotel

• 8.8 High severity

  MCPHub: Improper Neutralization of Special Elements used in a Command

  CVE-2025-11285Oct 5, 2025SamanhappyEPSS 6.48%

  A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection. The attack can be