CVE-2026-108699 in hyper-mcp
Summary
by MITRE • 10/11/2026
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in hyper-mcp versions through 0.8.3 represents a critical failure in the integrity verification mechanisms designed to secure plugin loading within the system. At its core, this flaw stems from an improper signature verification process where the cosign_verify_args function is configured with overly permissive defaults. Specifically, the implementation accepts any signer identity and OpenID Connect issuer without strict validation against a predefined allowlist or policy. This design oversight effectively neutralizes the security guarantees provided by digital signatures, as it allows attackers to bypass authentication checks that are intended to ensure only trusted, verified code executes within the environment.
The operational impact of this vulnerability is severe due to the capabilities associated with WebAssembly plugins in hyper-mcp. When an attacker controls a plugin image reference, they can exploit this verification flaw by signing a malicious container image using a free Sigstore keyless certificate. Because the system does not validate that the signer identity matches expected trusted authorities or that the OIDC issuer is legitimate, it treats these self-signed artifacts as authentic and safe to load. This allows the execution of arbitrary code with elevated privileges determined by the plugin's configuration, including access to host resources, filesystem modifications, and environment variable manipulation.
From a technical perspective, this issue aligns closely with CWE-295 Improper Certificate Validation, where software does not validate or incorrectly validates certificates against expected trust anchors. Furthermore, in the context of attack tactics, this vulnerability facilitates initial code execution via trusted software supply chain compromise, mapping to MITRE ATT&CK technique T1608. The ability to execute plugins with configured host and filesystem capabilities means that successful exploitation can lead to full system compromise, data exfiltration, or lateral movement within connected environments.
Mitigation strategies must focus on enforcing strict verification policies rather than relying on permissive defaults. Administrators should configure hyper-mcp to require specific signer identities and restrict allowed OIDC issuers to a known set of trusted authorities. Implementing an explicit allowlist for plugin sources ensures that only images signed by verified entities are accepted. Additionally, keeping the software updated to versions where this configuration is enforced by default or providing patches that mandate strict certificate validation will address the root cause. Security teams should also audit existing configurations to ensure no legacy settings override these security controls and monitor logs for unusual signature verification events.