Information Disclosure in samanhappy MCPHub Product
CVE-2026-120323

5.3MEDIUM

Key Information:

Vendor

Samanhappy

Status
Mcphub
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120323?

A security vulnerability has been identified in the samanhappy MCPHub affecting versions 1.0.45 and 1.1.7. This flaw resides in an unspecified function within the file src/utils/passthroughHeaders.ts, where improper handling of the passthroughHeaders argument leads to potential information disclosure. Attackers can exploit this vulnerability remotely, revealing sensitive information. To mitigate this risk, it is recommended to upgrade to version 1.1.8, which includes a necessary patch. The patch for this vulnerability is documented in commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76.

Affected Version(s)

MCPHub 1.0.0

MCPHub 1.0.1

MCPHub 1.0.2

References

https://vuldb.com/vuln/429655
vdb-entrytechnical-description
https://vuldb.com/vuln/429655/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-120323
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

chenhuanlin (VulDB User)
.