samanhappy MCPHub up to 0.12.14 Server Configuration /api/servers child_process.spawn command/args privileges management

Summaryinfo

A vulnerability identified as very critical has been detected in samanhappy MCPHub up to 0.12.14. This affects the function child_process.spawn of the file /api/servers of the component Server Configuration. This manipulation of the argument command/args causes privileges management. The identification of this vulnerability is CVE-2026-79748. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in samanhappy MCPHub up to 0.12.14 and classified as very critical. Affected by this vulnerability is the function child_process.spawn of the file /api/servers of the component Server Configuration. The manipulation of the argument command/args with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spawn the configured stdio process via child_process.spawn. Authentication is required, but there is no authorization check restricting these endpoints to admins, and there is no allowlist/sanitization on the command and args fields. As a result, any authenticated non-admin user can submit a server configuration with command:"/bin/sh" (or any other binary) and arbitrary args, causing MCPHub to execute the attacker-controlled process as the MCPHub server's OS user (commonly root in the published Docker image and in npx/systemd deployments). This issue has been patched in version 0.12.15.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-79748 since 08/25/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/31/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 0.12.15 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• samanhappy

Name

• MCPHub

Version

• 0.12.0
• 0.12.1
• 0.12.2
• 0.12.3
• 0.12.4
• 0.12.5
• 0.12.6
• 0.12.7
• 0.12.8
• 0.12.9
• 0.12.10
• 0.12.11
• 0.12.12
• 0.12.13
• 0.12.14

Website

• Product: https://github.com/samanhappy/mcphub/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion