Advisories · Technology
samanhappy MCPHub.
Every CVE that names samanhappy MCPHub among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
samanhappy MCPHub passthroughHeaders.ts information disclosure
- samanhappy MCPHub
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management
- samanhappy MCPHub
- Privilege escalation
- CVSS 7.6 High
MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
- samanhappy mcphub
- Authentication bypass
- CVSS 8.8 High
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
- samanhappy mcphub
- Privilege escalation
- Broken access control
- CVSS 7.1 High
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
- samanhappy mcphub
- Broken access control
- CVSS 8.1 High
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
- samanhappy mcphub
- Broken access control
- CVSS 7.1 High
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
- samanhappy mcphub
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
- samanhappy mcphub
- Broken access control
- CVSS 7.6 High
MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
- samanhappy mcphub
- Server-side request forgery (SSRF)
- CVSS 7.7 High
MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)
- samanhappy mcphub
- Broken access control
- CVSS 5.1 Medium
samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery
- samanhappy MCPHub
- Server-side request forgery (SSRF)