CVE-2026-94047: MCPHub Privilege Escalation Vulnerability

CVE-2026-94047 Overview

CVE-2026-94047 is an improper privilege management flaw (CWE-266) in samanhappy MCPHub versions up to and including 1.0.32. The vulnerability resides in the importTemplate function within src/services/templateService.ts, exposed through the Template Import Endpoint. Authenticated remote users can invoke the endpoint without the privilege checks required to import server templates. The maintainers resolved the issue in version 1.0.33 with commit 18a4467bc4ec6390b1f841d8a468a37e9922f837. A public exploit disclosure exists, though no in-the-wild exploitation has been reported.

Critical Impact
Authenticated low-privilege users can import server configuration templates that should be restricted to privileged administrators, weakening the trust boundary around MCPHub server configuration.

Affected Products

samanhappy MCPHub versions up to and including 1.0.32
Affected component: Template Import Endpoint (src/services/templateService.ts, function importTemplate)
Fixed in: MCPHub 1.0.33

Discovery Timeline

2026-09-20 - CVE-2026-94047 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database
Patch commit - 18a4467bc4ec6390b1f841d8a468a37e9922f837 released as part of MCPHub v1.0.33

Technical Details for CVE-2026-94047

Vulnerability Analysis

MCPHub exposes a template import endpoint that lets users apply predefined server configurations. In releases up to 1.0.32, the endpoint invoked importTemplate(template, owner) without passing the authenticated user context. The service therefore had no way to distinguish privileged administrators from ordinary authenticated callers. As a result, any authenticated user with access to the endpoint could import templates that create or modify server configurations, an action the application intended to gate behind privileged access.

The scope of impact is narrow because the CVSS 4.0 vector requires low-level authentication (PR:L) and yields low confidentiality, integrity, and availability effects on the vulnerable component. The primary risk is trust-boundary erosion around server configuration management inside MCPHub deployments.

Root Cause

The root cause is a missing authorization check on server configuration state changes, classified under CWE-266: Incorrect Privilege Assignment. The controller passed only the owner string to importTemplate and never verified whether the acting user held the privileged role required to persist template-defined server configurations. The fix introduces isPrivilegedServerConfig validation and forwards the authenticated currentUser object into the service so privilege can be enforced at the point of use.

Attack Vector

Exploitation requires network access to the MCPHub HTTP API and valid low-privilege credentials. An authenticated attacker sends a crafted request to the template import endpoint containing a template payload. Because the vulnerable code path never evaluates the caller's privilege level, the template is imported and the resulting server configuration is persisted. No user interaction is required.

typescript

// Patch in src/controllers/templateController.ts — enforce privileged config check on import
    const currentUser = (req as any).user;
    const owner = currentUser?.username || 'admin';

-    const result = await importTemplate(template, owner);
+    const result = await importTemplate(template, owner, currentUser);

    const statusCode = result.success ? 200 : 400;
    res.status(statusCode).json({
// Source: https://github.com/samanhappy/mcphub/commit/18a4467bc4ec6390b1f841d8a468a37e9922f837

typescript

// Patch in src/controllers/serverController.ts — import the new privileged-config validator
 import { disconnectUpstreamOAuth } from '../services/upstreamOAuthDisconnectService.js';
 import type { UpstreamOAuthDisconnectScope } from '../services/upstreamOAuthDisconnectService.js';
 import { normalizeServerConfigForPersistence } from '../utils/serverConfigPersistence.js';
+import { isPrivilegedServerConfig } from '../utils/serverConfigValidation.js';
 import { setCachedSystemConfig } from '../utils/systemConfigCache.js';
 import { DEFAULT_INSTALL_BASE_URL, withResolvedInstallBaseUrl } from '../utils/installBaseUrl.js';
 import { previewOpenApiToolStats } from '../services/openApiToolStatsService.js';
// Source: https://github.com/samanhappy/mcphub/commit/18a4467bc4ec6390b1f841d8a468a37e9922f837

Detection Methods for CVE-2026-94047

Indicators of Compromise

HTTP POST requests to the MCPHub template import endpoint originating from non-administrator user sessions.
Newly persisted MCPHub server configurations that do not correspond to a change made by an administrator in the management UI.
Unexpected changes to files or database records tied to server configuration state on MCPHub 1.0.32 or earlier.

Detection Strategies

Inspect MCPHub application logs for template import invocations and correlate the acting username with the authorized administrator list.
Compare the installed MCPHub version against 1.0.33; any version at or below 1.0.32 is vulnerable and should be treated as exposed until patched.
Diff current server configuration state against a known-good baseline to identify templates imported outside a change-control window.

Monitoring Recommendations

Enable authentication and authorization audit logging on MCPHub and forward events to a central logging platform.
Alert on any successful template import performed by an account that is not a member of the MCPHub administrator group.
Monitor the MCPHub GitHub repository (samanhappy/mcphub) for follow-up advisories and additional privilege-related fixes.

How to Mitigate CVE-2026-94047

Immediate Actions Required

Upgrade MCPHub to v1.0.33 or later, which includes commit 18a4467bc4ec6390b1f841d8a468a37e9922f837.
Review the MCPHub user list and remove or downgrade accounts that do not require access to the management API.
Audit existing server configurations for entries that may have been imported by non-privileged users prior to patching.

Patch Information

The fix is delivered in MCPHub 1.0.33. Commit 18a4467bc4ec6390b1f841d8a468a37e9922f837 adds a privileged configuration check via isPrivilegedServerConfig and passes the authenticated currentUser into importTemplate so authorization is enforced before templates are persisted. See Pull Request #1096 and Issue #1094 for the discussion history, and VulDB CVE-2026-94047 for additional metadata.

Workarounds

Restrict network access to the MCPHub management interface using a reverse proxy, VPN, or firewall rules until the upgrade is applied.
Temporarily disable the template import endpoint at the ingress layer if upgrading is not immediately feasible.
Rotate credentials for any low-privilege accounts that had access to the vulnerable endpoint before the patch was deployed.

bash

# Upgrade MCPHub to the patched release
npm install -g @samanhappy/mcphub@1.0.33

# Or, for a git-based deployment
git fetch --tags
git checkout v1.0.33
npm ci && npm run build

# Verify the installed version
mcphub --version   # expect: 1.0.33