CVE-2026-79750 in MCPHub
Summary
by MITRE • 08/31/2026
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own (list views and config edits enforce ownership), but the tool-execution API does not. Any authenticated non-admin user can invoke tools on MCP servers owned by other users — servers they cannot even see in GET /api/servers. Because connected MCP servers carry real capability (filesystem, HTTP fetch, cloud APIs with the owner's keys), this is cross-tenant compromise: demonstrated arbitrary host file read (/etc/passwd, another user's secrets) and SSRF. This issue has been patched in version 1.0.30.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
MCPHub serves as a centralized orchestration platform designed to manage multiple Model Context Protocol servers by exposing them through distinct endpoints with configurable routing strategies. The architecture relies on the assumption that access control mechanisms consistently enforce ownership boundaries across all interaction vectors within the application. Prior to version 1.0.30, this security model contained a critical inconsistency where authorization checks were applied selectively rather than uniformly. While read operations and configuration modifications correctly restricted non-admin users to resources they owned, ensuring visibility of only their own servers in list views and preventing unauthorized edits, the tool-execution API lacked these same safeguards. This discrepancy created a significant gap in the security perimeter, allowing authenticated non-administrative actors to bypass intended isolation boundaries through specific functional endpoints that were not subject to ownership validation logic.
The technical flaw stems from an incomplete implementation of access control policies within the backend service handling tool invocations. When a user attempts to execute tools on a connected MCP server, the system fails to verify whether the requesting user holds administrative privileges or owns the target server instance. Consequently, any authenticated user can supply identifiers for servers belonging to other tenants and trigger their associated capabilities. This represents a classic Broken Access Control vulnerability where the enforcement of security policies is inconsistent across different API methods within the same application domain. The absence of proper authorization checks in the execution path effectively nullifies the isolation mechanisms present in data retrieval and configuration management endpoints, rendering the ownership-based segmentation ineffective for operational activities that involve tool usage.
The operational impact of this vulnerability is severe due to the potent capabilities inherent in connected MCP servers. These servers often possess access to sensitive resources such as local file systems, external HTTP services, and cloud provider APIs using credentials owned by their respective administrators. An attacker exploiting this flaw can achieve cross-tenant compromise by invoking tools that read arbitrary files from the host system, potentially exposing critical configuration data like /etc/passwd or extracting secrets stored in environment variables or config files belonging to other users. Furthermore, the ability to trigger HTTP fetch operations enables Server-Side Request Forgery attacks against internal network services that may not be directly accessible from the public internet but are reachable by the MCPHub host machine. This effectively allows an attacker to pivot through the compromised server infrastructure and interact with backend systems under the identity of the victim tenant.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically regarding insufficient authorization checks for critical functions. It also maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as it allows an attacker to execute commands or scripts via the MCP tool interface, and potentially T1048 Exfiltration Over Alternative Protocol if data is exfiltrated through HTTP requests initiated by the compromised server. The scenario illustrates how inconsistent enforcement of access controls can lead to privilege escalation in a multi-tenant environment, undermining the fundamental security principle that users should only interact with resources they are explicitly permitted to access.
To mitigate this risk, organizations must ensure that all API endpoints enforcing resource ownership apply consistent authorization logic regardless of the operation type. The vulnerability has been addressed in version 1.0.30 by implementing strict ownership verification for tool execution requests. Administrators operating older versions should upgrade immediately to patch this flaw. Additionally, defense-in-depth strategies such as network segmentation between MCPHub and internal services, along with rigorous input validation on all API parameters, can help limit the blast radius of similar vulnerabilities in other components of the infrastructure. Regular security audits focusing on access control consistency across different functional areas are essential to prevent recurrence of such authorization bypasses.