Login Request a demo
MC
Product
mcphub
by samanhappy · last CVE Sep 20, 2026
13
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 2High 7Medium 4Low 0
Severity
All severities13Critical2High7Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add mcphub to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-79748
9.9
1%
Aug 31
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
Affected: < 0.12.15
CVE-2025-11287
9.8
1%
Oct 5
samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication
Affected: 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; +5 more
CVE-2026-79744
8.8
1%
Aug 31
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
Affected: < 1.0.29
CVE-2025-11285
8.8
8%
Oct 5
samanhappy MCPHub serverController.ts os command injection
Affected: 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; +5 more
CVE-2026-79746
8.1
0%
Aug 31
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
Affected: < 1.0.31
CVE-2026-79750
7.7
0%
Aug 31
MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)
Affected: < 1.0.30
CVE-2026-79749
7.6
0%
Aug 31
MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
Affected: < 1.0.32
CVE-2026-79745
7.1
0%
Aug 31
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
Affected: < 1.0.32
CVE-2026-79747
7.1
0%
Aug 31
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
Affected: < 1.0.32
CVE-2026-79743
6.9
1%
Aug 31
MCPHub: Path Traversal via Malicious MCPB Manifest Name
Affected: < 0.12.13
CVE-2026-90474
6.8
1%
Sep 12
MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
Affected: before 1.0.32
CVE-2026-94047
6.3
0%
Sep 20
samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management
Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +27 more
CVE-2025-11286
4.7
0%
Oct 5
samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery
Affected: 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; +5 more
Showing 13