CVE-2026-79750: MCPHub Authentication Bypass Vulnerability

CVE-2026-79750 Overview

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple Model Context Protocol (MCP) servers and APIs behind flexible routing strategies. Versions prior to 1.0.30 contain a broken access control flaw [CWE-639] in the tool-execution API. While list views and configuration edits enforce per-owner scoping, the tool-execution endpoint does not check ownership. Any authenticated non-admin user can invoke tools on MCP servers owned by other tenants, including servers hidden from GET /api/servers. The issue is patched in version 1.0.30.

Critical Impact
Authenticated low-privilege users can execute tools on other tenants' MCP servers, enabling arbitrary host file reads (for example /etc/passwd and other users' secrets) and Server-Side Request Forgery (SSRF) using the victim owner's credentials.

Affected Products

MCPHub (samanhappy/mcphub) versions prior to 1.0.30
Deployments exposing the MCPHub tool-execution API to multi-tenant users
MCP server integrations with filesystem, HTTP fetch, or cloud API capabilities

Discovery Timeline

2026-08-31 - CVE-2026-79750 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-79750

Vulnerability Analysis

MCPHub implements per-user server ownership across most of its API surface. Non-admin users only see and manage the MCP servers they own through list and configuration endpoints. The tool-execution API, however, omits the ownership check that governs the rest of the resource model. This inconsistency allows a low-privilege authenticated caller to reference an MCP server by identifier and invoke any tool it exposes, regardless of who owns it.

Because MCPHub is an orchestration layer, each connected MCP server carries real backend capability. Servers typically hold owner-scoped filesystem access, outbound HTTP fetch, or cloud provider API keys. Executing tools cross-tenant therefore inherits the victim owner's privileges. Public advisory materials demonstrate arbitrary host file reads, including /etc/passwd and secrets belonging to another user, and SSRF against internal network destinations.

Root Cause

The root cause is an Insecure Direct Object Reference (IDOR) in the tool-execution route [CWE-639]. Authorization on this endpoint validates only that the caller is authenticated. It does not verify that the target MCP server's owner matches the caller or that the caller is an administrator. Ownership enforcement present elsewhere in the API is not applied consistently.

Attack Vector

An attacker needs a valid non-admin MCPHub account and network reachability to the tool-execution endpoint. The attacker enumerates or guesses server identifiers owned by other tenants, then issues a tool-invocation request against those identifiers. The MCPHub backend forwards the call to the victim's connected MCP server, executing the tool with that server's capabilities and credentials. Successful invocations return tool output, including sensitive file contents or responses from internal SSRF targets.

See the GitHub Security Advisory GHSA-wfqf-hqwq-8wvf for the maintainer's technical description.

Detection Methods for CVE-2026-79750

Indicators of Compromise

Tool-execution API requests where the authenticated user's identifier does not match the owner of the referenced MCP server.
Successful reads of sensitive host paths such as /etc/passwd, .env, SSH keys, or cloud credential files returned through MCPHub tool responses.
Outbound HTTP fetches from MCPHub to internal or metadata endpoints (for example 169.254.169.254) initiated by non-admin users.

Detection Strategies

Correlate MCPHub authentication logs with tool-execution logs to flag calls that target servers not owned by the caller.
Alert on non-admin accounts invoking a statistically unusual number of distinct MCP server identifiers within a short window.
Inspect MCP server output logs for filesystem reads outside the application's expected working directory.

Monitoring Recommendations

Enable verbose audit logging on the MCPHub tool-execution endpoint, capturing caller identity, target server ID, and tool name.
Forward MCPHub and connected MCP server logs to a centralized SIEM or data lake for cross-tenant correlation.
Monitor egress from hosts running MCPHub for SSRF-style traffic to link-local, private, and cloud metadata ranges.

How to Mitigate CVE-2026-79750

Immediate Actions Required

Upgrade MCPHub to version 1.0.30 or later on all instances.
Rotate any credentials, API keys, or tokens configured in MCP servers that were reachable during the vulnerable window.
Review tool-execution logs for cross-tenant invocations and treat matching accounts as potentially compromised.
Restrict MCPHub network exposure so only trusted users can reach the tool-execution API.

Patch Information

The maintainer fixed the flaw in MCPHub release v1.0.30. The patch enforces ownership checks on the tool-execution API so non-admin users can invoke tools only on MCP servers they own. Administrators retain broader access. Upgrading is the only supported remediation.

Workarounds

If immediate patching is not possible, restrict MCPHub to single-tenant use or limit accounts to administrators only.
Place MCPHub behind an authenticating reverse proxy that scopes API access per tenant.
Remove high-impact MCP server integrations (filesystem, cloud API keys, unrestricted HTTP fetch) until the upgrade is complete.

bash

# Upgrade MCPHub to the patched release
git fetch --tags
git checkout v1.0.30
# Or for container deployments
docker pull samanhappy/mcphub:1.0.30
docker compose up -d