CVE-2026-79745: MCPHub Privilege Escalation Vulnerability

CVE-2026-79745 Overview

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple Model Context Protocol (MCP) servers and APIs. Versions prior to 1.0.32 contain a missing authorization flaw [CWE-862] in the built-in prompt and resource controllers. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes attach to the authenticated router without any admin gate, and the handlers never read req.user. A non-admin authenticated user can create, overwrite, and shadow global prompt templates and resources served to every other user of the hub.

Critical Impact
Any authenticated non-admin user can tamper with globally-served prompts and resources, enabling stored prompt injection into other users' LLM sessions.

Affected Products

MCPHub versions prior to 1.0.32
MCPHub built-in prompt controller (builtinPromptController.ts)
MCPHub built-in resource controller (builtinResourceController.ts)

Discovery Timeline

2026-08-31 - CVE-2026-79745 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-79745

Vulnerability Analysis

MCPHub exposes REST endpoints under /api/prompts* and /api/resources* for managing built-in prompt templates and resource records. These routes sit behind the authenticated router but lack any role check. The handlers accept mutations from any logged-in principal and never inspect req.user to enforce administrative privilege.

The Data Access Object (DAO) singletons behind these controllers are consulted first in handleGetPromptRequest and handleReadResourceRequest, ahead of any connected MCP server. Records written by a low-privilege user therefore shadow legitimate upstream content for every subsequent session. Downstream, this enables stored prompt injection against other users' large language model (LLM) sessions, but the scored primary impact is unauthorized integrity violation of globally-served records.

Root Cause

The root cause is missing authorization on privileged mutation endpoints. The controllers were registered on the authenticated router without a requireAdmin middleware, and the handler logic never verified role claims on the request principal before writing to shared DAO singletons.

Attack Vector

An attacker requires a valid non-admin account on the target MCPHub instance. Using standard HTTP POST or PUT requests against /api/prompts* or /api/resources*, the attacker writes attacker-controlled content into the shared DAO. Every downstream user session subsequently receives the tampered prompt template or resource.

typescript

// Security patch: src/controllers/builtinPromptController.ts
 import { Request, Response } from 'express';
 import { ApiResponse, BuiltinPrompt } from '../types/index.js';
 import { getBuiltinPromptDao } from '../dao/index.js';
+import { requireAdmin } from '../utils/requireAdmin.js';
 import { logger } from '../utils/logger.js';

Source: GitHub Commit 6ba55ac

The patch adds the requireAdmin middleware import and applies it to mutation routes in both the prompt and resource controllers.

Detection Methods for CVE-2026-79745

Indicators of Compromise

Unexpected POST or PUT requests to /api/prompts or /api/resources originating from non-admin sessions.
New or modified built-in prompt or resource entries in the MCPHub DAO that do not correspond to administrator activity.
LLM session outputs that contain instructions or content not present in the upstream MCP server definitions.
Prompt or resource records whose author or updatedAt metadata references a non-admin account.

Detection Strategies

Audit MCPHub application logs for successful 2xx responses to POST/PUT /api/prompts* and POST/PUT /api/resources* from users whose role is not admin.
Diff current stored prompts and resources against a known-good baseline captured before upgrade.
Correlate mutation timestamps in the DAO with authentication logs to identify low-privilege actors performing writes.

Monitoring Recommendations

Enable request logging with authenticated user identity and role on all /api/prompts* and /api/resources* routes.
Alert on any write operation to built-in prompt or resource endpoints outside a defined administrative change window.
Track version drift by monitoring the MCPHub release tag deployed in production against v1.0.32 or later.

How to Mitigate CVE-2026-79745

Immediate Actions Required

Upgrade MCPHub to version 1.0.32 or later, which enforces admin role checks on prompt and resource mutation routes.
Review all existing built-in prompt and resource records and remove or restore any entries written by non-admin accounts.
Rotate any MCPHub session tokens or API credentials that may have been used to abuse the vulnerable endpoints.
Restrict network access to the MCPHub /api/* surface to trusted management networks until patching is complete.

Patch Information

The fix is delivered in MCPHub v1.0.32. The patch adds a requireAdmin middleware to the built-in prompt and resource controllers so that only administrator principals can invoke POST/PUT mutation routes. Refer to GitHub Release v1.0.32, Pull Request #1069, and GitHub Security Advisory GHSA-6cvf-cfch-4g7m for details.

Workarounds

If immediate upgrade is not possible, place an authenticating reverse proxy in front of MCPHub that blocks POST and PUT methods to /api/prompts* and /api/resources* for non-admin users.
Temporarily restrict account creation and require administrator approval for all authenticated users on the hub.
Disable the built-in prompt and resource features if they are not required in your deployment.

bash

# Example nginx block: restrict prompt/resource mutations to admin source IPs
location ~ ^/api/(prompts|resources) {
    limit_except GET {
        allow 10.0.0.0/24;   # admin management subnet
        deny  all;
    }
    proxy_pass http://mcphub_backend;
}