CVE-2026-79747: MCPHub Server-Side Request Forgery Vulnerability

CVE-2026-79747 Overview

CVE-2026-79747 is a Server-Side Request Forgery (SSRF) vulnerability in MCPHub, a unified hub that centrally manages and dynamically orchestrates multiple Model Context Protocol (MCP) servers and APIs into separate endpoints. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL. MCPHub then issues server-side requests to that URL with no egress filtering. The hub does not block loopback, RFC1918, or link-local (169.254.0.0/16) destinations. The vulnerability is tracked as CWE-918.

Critical Impact
Authenticated attackers can pivot MCPHub into internal networks, reach cloud metadata endpoints, and exfiltrate reflected response bodies through the OpenAPI proxy path.

Affected Products

MCPHub versions prior to 1.0.32
MCPHub OpenAPI proxy path (reflected SSRF)
MCPHub SSE/streamable-http transport (blind SSRF)

Discovery Timeline

2026-08-31 - CVE-2026-79747 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-79747

Vulnerability Analysis

MCPHub allows any authenticated user, including non-admin roles, to register a new MCP server entry with an attacker-controlled URL. Once registered, the hub initiates outbound HTTP requests to that URL as part of its normal orchestration behavior. The service performs no validation of the target host or IP range before dispatching the request.

Two request paths are affected with different exploitation properties. The OpenAPI proxy path returns the full upstream response body to the caller, producing a reflected SSRF suitable for reading data from internal services. The SSE and streamable-http transport paths dispatch the request but do not return content, producing a blind SSRF still usable for reachability probing, state changes on internal APIs, and interaction with cloud instance metadata services.

Root Cause

The root cause is missing egress filtering on user-supplied server URLs. MCPHub does not enforce an allowlist of destinations and does not reject requests to loopback addresses (127.0.0.0/8), RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or link-local ranges including 169.254.0.0/16. Authorization is also insufficient because server registration is not restricted to administrators.

Attack Vector

An authenticated non-admin user submits a server registration containing a URL that references an internal service, a cloud metadata endpoint at 169.254.169.254, or a loopback-bound admin interface. The attacker then invokes the OpenAPI proxy path against the registered server to read the reflected response, or triggers the SSE/streamable-http transport to send blind requests. The vulnerability requires network access to MCPHub and valid low-privilege credentials.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-9wx9-prgc-gmjr for maintainer details.

Detection Methods for CVE-2026-79747

Indicators of Compromise

Server registration events in MCPHub audit logs where the target URL resolves to loopback, RFC1918, or 169.254.0.0/16 ranges.
Outbound HTTP requests from the MCPHub host to cloud instance metadata services such as 169.254.169.254.
Unexpected OpenAPI proxy invocations from non-admin accounts returning large or sensitive response bodies.

Detection Strategies

Inspect MCPHub configuration and database entries for registered servers whose URLs point at internal-only destinations.
Correlate authentication logs of non-admin users with subsequent MCP server registration and proxy-invocation activity.
Alert on egress traffic from the MCPHub process to private address space that was not present in a known-good baseline.

Monitoring Recommendations

Enable and forward MCPHub application logs to a centralized store for retention and query.
Monitor host-level network telemetry from the MCPHub server, focusing on connections to metadata and internal management endpoints.
Review role assignments periodically to confirm that server registration privileges match intended administrative boundaries.

How to Mitigate CVE-2026-79747

Immediate Actions Required

Upgrade MCPHub to version 1.0.32 or later, which contains the maintainer fix.
Audit all currently registered MCP servers and remove entries pointing at loopback, RFC1918, or link-local destinations that were not administrator-approved.
Rotate any cloud instance credentials that may have been exposed if metadata endpoints were reachable from the MCPHub host.

Patch Information

The issue is patched in MCPHub 1.0.32. Release notes are published at GitHub Release v1.0.32 and the coordinated advisory is available at GitHub Security Advisory GHSA-9wx9-prgc-gmjr.

Workarounds

Restrict MCPHub server registration to trusted administrators until the upgrade is deployed.
Place MCPHub behind an egress proxy or network policy that blocks outbound requests to 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.
Use Instance Metadata Service v2 (IMDSv2) with hop-limit hardening on cloud hosts running MCPHub to reduce metadata exposure.

bash

# Example iptables egress restriction for the MCPHub host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT