Authorization Bypass Vulnerability in MCPHub by Saman Happy

CVE-2026-79748

What is CVE-2026-79748?

MCPHub, a platform for managing multiple MCP servers, is vulnerable due to a lack of authorization checks on critical endpoints. Specifically, the POST /api/servers and PUT /api/servers/:name endpoints allow authenticated non-admin users to submit malicious configurations. This can lead to arbitrary command execution by launching an attacker-controlled process as the server's operating system user, which is often root in Docker or npx/systemd environments. The vulnerability has been addressed in version 0.12.15, emphasizing the need for strict access controls and input validation.

References