What’s Vulnerable › Products

samanhappy mcphub vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your samanhappy mcphub version is affected

Latest samanhappy mcphub vulnerabilities

• CVE-2026-94047 — samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management (CVSS 6.3)
• CVE-2026-90474 — MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass (CVSS 6.8)
• CVE-2026-79750 — MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF) (CVSS 7.7)
• CVE-2026-79749 — MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation (CVSS 7.6)
• CVE-2026-79748 — MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args) (CVSS 9.9)
• CVE-2026-79747 — MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial) (CVSS 7.1)
• CVE-2026-79746 — MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching (CVSS 8.1)
• CVE-2026-79745 — MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources) (CVSS 7.1)
• CVE-2026-79744 — MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration (CVSS 8.8)
• CVE-2026-79743 — MCPHub: Path Traversal via Malicious MCPB Manifest Name (CVSS 6.9)
• CVE-2025-13822 — Authentication bypass in MCPHub (CVSS 5.3)
• CVE-2025-11287 — samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication (CVSS 9.8)
• CVE-2025-11286 — samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery (CVSS 4.7)
• CVE-2025-11285 — samanhappy MCPHub serverController.ts os command injection (CVSS 8.8)