CVE-2026-79745 in MCPHub
Summary
by MITRE • 08/31/2026
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user. The DAO singletons they write are consulted first — ahead of any connected MCP server — for every session in handleGetPromptRequest / handleReadResourceRequest. A non-admin can therefore create, overwrite, and shadow global prompt templates and resources that all other users are served. The scored impact is the unauthorized integrity violation (creation/tampering/shadowing of globally-served records); stored prompt injection into other users' LLM sessions is a downstream consequence of that tampering. This issue has been patched in version 1.0.32.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in MCPHub prior to version 1.0.32 represents a critical failure in access control mechanisms within the application's core routing and controller logic. MCPHub functions as a centralized orchestration layer for multiple Model Context Protocol servers, managing API endpoints with flexible routing strategies. The security flaw resides specifically in the built-in prompt and resource controllers that handle requests to the mutating POST and PUT routes under /api/prompts and /api/resources. Although these routes are attached to an authenticated router requiring user login, they lack any subsequent authorization checks or role-based access control gates. This architectural oversight allows any authenticated user, regardless of their privilege level, to execute administrative functions intended exclusively for system administrators.
From a technical perspective, the root cause is that the request handlers never inspect the req.user object to verify permissions before processing mutations. Furthermore, the data persistence layer operates in a manner that exacerbates this flaw; the DAO singletons consulted during handleGetPromptRequest and handleReadResourceRequest are checked first for every session, ahead of any connected MCP server logic. This design means that if an attacker successfully writes malicious or disruptive content to these global prompt templates and resources via the unprotected endpoints, that content is immediately served to all subsequent users requesting prompts or resources. The system fails to distinguish between user-specific data and globally shared configuration, treating unauthorized mutations as valid administrative updates.
The operational impact of this vulnerability is severe, primarily categorized as an unauthorized integrity violation where a non-administrator can create, overwrite, or shadow global prompt templates and resources. This leads directly to stored prompt injection attacks against other users' Large Language Model sessions. By injecting malicious instructions into the globally served prompts, an attacker can manipulate how the LLM responds for every user in the system, potentially leading to data exfiltration, unauthorized actions performed by the AI on behalf of victims, or complete disruption of service through harmful output generation. This transforms a simple authentication bypass into a widespread compromise of multi-tenant integrity and confidentiality.
In terms of industry standards, this vulnerability aligns with CWE-269 Improper Privilege Management, as users are able to perform actions requiring higher privileges than they possess. It also relates closely to CWE-732 Incorrect Permission Assignment for Critical Resource, since the critical resources (global prompts) are accessible without proper authorization checks. From a threat modeling perspective using MITRE ATT&CK techniques, this maps to T1059 Command and Scripting Interpreter if used to inject code-like instructions into LLMs, or more broadly to T1486 Data Encrypted for Impact in the context of disrupting service integrity through malicious prompt injection.
The issue has been patched in version 1.0.32 by implementing proper role-based access control on the mutating endpoints. Mitigation strategies include ensuring that all administrative routes enforce strict authorization checks against user roles before processing requests, validating that only users with specific admin privileges can modify global system configurations. Additionally, developers should implement input validation and sanitization for prompt content to mitigate downstream injection risks even if access controls are bypassed in other contexts. Regular security audits of routing logic and permission assignments are recommended to prevent similar privilege escalation flaws in future updates.